I understand that a lot of APIs are protected using a (possibly public)
API Key, to identify who is making the request, and a
secret to hmac the parameters and determine if the client is actually who claims to be.
The thing is, if I'm sure the
API Key is private and use
- What are the risks of not using a secret to "sign" the request?
- The only one that comes to my mind is a MiTM modifying the parameters, but it should not be a concern if I use HTTPS, right?
- Is it another layer of security just to be sure?