Hacker News Reader

Why did you guys decide to have the API endpoints a) use plain HTTP and b) include the API key as a query parameter? While it doesn't look like the API lets you access anything particularly sensitive, you're just asking for API keys to be sniffed out and used/abused by folks other than those you issued the key for.

View on HN

It's a fair complaint. I'm not sure when we're getting everything to HTTPS, but I know it's on the roadmap. Including the API key as a parameter goes back to the early days of our API - quite a few years ago. The problem now is that we have enough apps with enough traffic that we can't just move it to the header without causing a bit of disruption. But that too is on our roadmap. Both issues are important.

It should still be fairly easy to check for an API Key in the header if not found in the request parameters. This way there would be no disruption for old apps, and it would benefit new apps.

I also think that both this and HTTPS are mandatory, but since it's on your roadmap that's good enough.

Reply on news.ycombinator.com