I'm currently designing a API Model to use. A user will have a 'secret_api_key' and a 'public_api_key'. They will send a request to my server with the public key, the form data, and then a hash. The hash is the form data encrypted with the 'secret_api_key'.
This is so that the server will recreate this hash since it knows the 'secret_api_key' and if the hashes are the same then accept the request, else deny it.
My problem is, if someone were to do this using JavaScript then they would have to encrypt this 'on the go' in the browser meaning they will need the 'secret_api_key' to hash it all. But the 'secret_api_key' is meant to be kept away from public eyes, so anyone would be able to look at the script and see the secret key.
Is this a wrong way of doing it? I honestly can't think of a way that you would be able to use my API within a browser using JavaScript (Which would be the main method in which people would use my API)
I know with OAuth you get a 'access_token' which you just send with a request, surely someone could use a traffic sniffer and resend requests with the same access token? Or does OAuth working differently?
Any help or suggestions would be much appreciated.
Thank you.