Hacker News Reader

API keys are for identification and secrets are for authentication.

Use a username / password because it’s the same thing.

You can automatically apply policies such as expiration and manual rotation to API keys/tokens. You can’t really do that seamlessly for username/password combinations.

Reply on news.ycombinator.com