Many APIs protected with API keys only use the secret key (i.e. a password) without something like an account ID or username.
For example Stripe API uses the secret key as the username in Basic Auth, leaving the password blank:
curl https://api.stripe.com/v1/charges \ -u sk_test_BQokikJOvBiI2HOWgH4olfQ2:
How does this work server-side? Does it look for the secret in a table with the secrets as primary keys, in plain text? What happens if this table is leaked?
Why is this better than to use a
account_id:secret_key combo in the authentication? You can then store
bcrypt(secret_key) instead of the
secret_key in plain text, using the
account_id as the primary key.
Related, but not the same