We have a few in house endpoint that we'd like to keep in house and be used by developers who have access to different servers. We were going to generate a secret key, save the key on the respective servers, and then add it to the cURL request in the Authorization:Bearer header such as:
curl -H "Authorization:Bearer some-token" https://www.some-endpoint.com
to be then verified when the endpoint was hit.
After doing some googling around, I noticed that Stripe uses:
curl https://api.stripe.com/v1/transfers -u sk_some_secret_key -d amount=some_amount -d currency=usd -d destination=some_account
so that the key isn't sent as part of the header. From a security standpoint, is one method more secure than the other?