Quite a few API's have something like a 'username' and a 'secret'.

Is there anything against the decission to just work with a (generated) secret?

Of course the secret should be long enough - GUID like.

It feels simpler to me because you can only mess up one thing instead of two, but maybe I'm missing something here.

1 Answer 1


As far as the UX is concerned, no there's nothing wrong with it. APIs are typically handled by developers who have enough knowledge of how to get it working with enough information. At my last company we built an API for clients who had their own tech team/person and we actually didn't even use a username, just a secret key that is automatically generated the first time that user accepts API access.

After that process was instituted, something like 2 years ago, no one has had trouble with it of the 50-100 clients that have used it since.

So no, you're not missing anything. It can be that simple. If you want to make it more secure you can offer more complexity, like a username (which is typically recommended), and even a password, but that's for security purposes only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.