用户如何通过用户名和密码传递API密钥？

Question

I'm following this tutorial and it works like a charm. But many things are harcoded so I need to change them. I have to check in DB if the username and password are correct and so on... But I don't understand how API keys (or service keys) works.

On the tutorial code, the service key is passing through HTTP header, and then the login method checks if it is matching with username and password provided. But if each user has a unique service key, how users can pass it through HTTP header? Users put their usernames and password into form fields and then press the login button

The tutorial says that the service key is provided to the user by email or other methods. But how the user enters it in the HTTP header of the login form? Where this service key is coming from?

Answer 1

The service key is to give access to the API, not individual users. So take twitter for example: twitter users log in with username and password and don't need a service key. But if you wanted to build your own twitter platform where users can log in to your page and see their tweets in your app (like tweetdeck), you'd need to get a service key to use the twitter API, and you'd send this key along with your http requests from your server to twitter every-time a user logs into your page. Service keys are a way of identifying clients (ie applications) using the API, not specific users using the application.