title: Is it safe to ask the user for their API credentials to fetch information?
body: <p>I am building an analytics web application for PayPal. Currently, when the user signs up on my app, I ask them to enter their API Key, Password and Secret. Then I use PayPal's Classic API to retrieve transaction history. Although I only use the API credentials to retrieve the info and don't actually store it in my database (only store transaction history information), I'm not sure if this is the best or safest method.</p>
  
  <p>I didn't find any "Connect to PayPal" type mechanism that other services (like Stripe) offer. So is the way I am doing it the only good way?</p>