As the topic is a bit vague I have decided to ask you guys here what do you think and what is the best practice in given scenario.  

Disclaimer: I am programmer, and although I know a bit about security I don't posses an in-depth knowledge of attack, security and exploit methods and opportunities in given scenario.  

I am working on connecting our system with the external system that is going to consume and process some of data we are sending to them.

Potential problem that I see is in Auth part of making request.

They want us to create GET request on their Api endpoint. It is secure (HTTPS) endpoint, and username and password are to be sent in body of request (application/x-www-form-urlencoded). In return we are to get back token for further authentication.

I know that sending Username and Password in Get method type would be security nightmare as URL's persist in browsers history.

I have read about similar situation HERE and HERE talking about security through obscurity but I am not sure if it applies here.

Why I don't think this is security issue:

• We are not authenticating using browser, rather HttpClient
• Data is sent in body of request
• Endpoint is using secure protocol (HTTPS)

What do you think ? Is this wrong approach and/or potential security risk ?