User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
Quite a few API's have something like a 'username' and a 'secret'.
Is there anything against the decission to just work with a (generated) secret?
Of course the secret should be long enough - GUID like.
It feels simpler to me because you can only mess up one thing instead of two, but maybe I'm missing something here.
As far as the UX is concerned, no there's nothing wrong with it. APIs are typically handled by developers who have enough knowledge of how to get it working with enough information. At my last company we built an API for clients who had their own tech team/person and we actually didn't even use a username, just a secret key that is automatically generated the first time that user accepts API access.
After that process was instituted, something like 2 years ago, no one has had trouble with it of the 50-100 clients that have used it since.
So no, you're not missing anything. It can be that simple. If you want to make it more secure you can offer more complexity, like a username (which is typically recommended), and even a password, but that's for security purposes only.
