When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, because it was in my browser's history. Seeing my password in plain text there made me feel very uncomfortable. Of course, this will never happen in the XHR request, which is the only way the api url is accessed.
But still, it got me thinking. First I did my research on if it is right to send sensible data in plain text and if I shouldn't encrypt or at least base64 encode it, but it's said it is normal to send data in plain text when you're using HTTPS (which of course I do on my website!).
Then I was like: fine, then let me just swap to a POST request instead. This feels better for me than seeing the data in the URL. But this would interfere with the idea of RESTful APIs. It should be a GET request.
So what can I do? What should I do? Or what you just do nothing? I'm curious.