This may sound like a silly question, because passwords, of course, need to be hashed and never store the original.
However, for API secrets, as a rule, I see that they appear in the box when registering for them.
For example, if I go to the google api console and see my credentials page, I can view the secret information about my client, the same goes for twitter.
Surely api keys are just as sensitive as passwords?
Is it just because on the part of the provider you can be sure that a sufficiently strong password is generated? If this case does not provide any protection, your database is compromised.
Or is it possible because if you use token-based authentication, you are either doing a type of password provision that requires you to send your credentials along with the client ID and secret or update token so that the user can already have to compromise?
source
share