title: Rest API under https security
body: <p>I am new and need directions so I can ask the correct questions. Here's the deal:</p>
  <p>I have developed a REST API under HTTPS.</p>
  <p>The user must provide a valid token to use the API.</p>
  <p>The token expires after not being used for more than 5 minutes.</p>
  <p>To obtain the token, the client must call the authentication API passing his private primary or secondary key, along with his user number.</p>
  <p>Each key is unique, and on the database I save it's hash.
  The user passes his primary or secondary key through the header with key &quot;pk&quot; or &quot;sk&quot; and &quot;usernumber&quot;.</p>
  <p>The server will get those keys and send to the database, which will apply the hash and check if they are valid.</p>
  <p>Once the keys are valid, a token itself is generated on the database, and returned to the user.</p>
  <p>My concern regards passing the primary key or secondary key on the headers. I am not sure if someone can obtain those data from outside and neither if it is the best practice. I am trying to get some directions, and I have came upon basic auth, oauth, and others. But they all seem to be on HTTP.
  I have not found much about API HTTPS, so I also need some directions here. Can I make my API accept only https requests? If so, does the same security rules apply?</p>
  <p>Thanks in advance.</p>