Hacker News Reader

So a password or private encryption key isn't security?

Obscurity is a perfectly fine security layer as you said yourself (i.e. it is one of many layers).

Relying ONLY on obscurity is a failure.

What is a UUID if not a fairly predictable object-based shared authorization token?

EDIT: I'm mostly kidding.

Just call it an object-specific API key, that forms part of the URI instead of being a header value. Since we are using https it's all good.