Hacker News Reader

I think this is a novel concept, but I think people will see the password and be a bit skeptical to use it (I realize you can use the secret key). You will need a way to build trust with consumers so that they use your service. As well, you will need to prove that my password (or secret key) aren't logged ANYWHERE for me to use the service.

View on HN

Thanks for the feedback! This is an area I've gone back and forth on. Originally I didn't want to accept a user/password as I realized many wouldn't trust this. Without allowing it, I was worried I'd lose people that have never used API keys before. The hope of the video link below the 'Let me have it' button showing how to make read only keys was that people would trust that they could give me a set of keys that allowed restrained access. In addition, the read only keys created could be deleted immediately afterwards if it was of concern.

Any thoughts on how I could better communicate this + build trust with users in this setting?

I think the API keys are fine by themselves, I think the willingness to accept the API keys only shows that you have a commitment to keeping their data secure. You could offer a "free" consultation service to show people have to make the API keys so that if they do become lost or don't know what they are doing, you can guide them and they know that your first priority is not only their service, but the security of their data.

Reply on news.ycombinator.com