I read this article on soundcloud's api:
It talks about consuming your own API. What I don't understand is how they avoid giving away the secret key. If you normally give the secret key to a developer who is going to use it in his API how do you give the secret key to yourself and avoid divulging it without transferring it over the wire? I am assuming there is a new secret key for each user. Otherwise each user would have the same secret key and a new public key and I am not sure if that would work.
I am not talking about developers. I am talking about users like us are to Stack Exchange (actual users of the app itself). My app will be consuming it's own API. Each user that signs up for the app (I assume) would get a private and public key. Each call to the API would need to (potentially) authenticate with a public and private key. If in this situation the user is a regular user of the app, how does one get the private key to the user. Or is this not the best way to do this?