api security implementation php

Question

I have a site that allow users to check their statistics (number of file uploaded, how many files they have, quotas, type of access etc...)

I create a section on my site: api.domain.com

This can be access via curl or a web browser since I am returning a json object or xml (depending on the user prefs)

My question is this: should I restrict the access using a user/pass or should I create a hash of the user file?

for example:

scenario 1:

The user create a php curl that sends user and pass via post or the curl auth and get back the results, parse it etc...

For me this is secure but the user has to maintain his script if they change their pass

scenario 2

The user access a file like: api.domain.com/j355HGssgf3HESAjh45jusf4325GSj5hbsHhdh5HGHFS3732he4548475wbe3447nSNe5XfgjhGJ and then access the data

This one, nothing to maintain

Answer 1

Here's my thoughts on this.

If you return a page not found or an error message (with a good 200 OK status) when a request is made to your page, it might send to bots or UN-trustable people a clue on what can they get and try again and again and again ...

On the other hand, if you send a access denied, like a 401, or better a 500 error code to simulate a server error, these bots or UN-trustable people might go away for good.

I will say the user/password method is a little more secure in this case.

Now, would you trust simply entering a big string (like scenario 2) when you check your mail? or your bank account information?