Why use OpenProject apikeys for user authentication?

[girish17]

Why not username and password?

[girish17]

Using username and password directly would have some advantages:

• It is intuitive for the user who then just has to provide those just as they would when logging into OpenProject.
• No extra logic for token management necessary.

On the other hand using API keys has some advantages too, which is why we went for that:

• If compromised while saved on an insecure client the user only has to regenerate the API key instead of changing their password, too.
• They are naturally long and random which makes them invulnerable to dictionary attacks and harder to crack in general.

Answer borrowed from : https://www.openproject.org/docs/api/introduction/#why-not-username-and-password