Use hawk to sign requests to the server about taskchampion HOT 2 CLOSED

It looks like this is a bit tricky with Actix-web.

One of the disadvantages of Hawk is that it requires the cleartext secret on the server. So it's basically bearer authentication, with signing of request, response, and payloads.

Other options, that might be just as good:

• Simple bearer auth with an API key. Yeah, there's no signing, but assuming that TLS is not compromised, there's nothing that an attacker without the API key could forge.
• Maybe just use simple client ID's with nothing further -- these are already opaque values and have enough bits to be unguessable. They're currently in the URL, but w could move that to a request header pretty easily. As an example, Mullvad VPN does something like this, with an opaque "account number" and no further information.

from taskchampion.

I think the second idea is the right one. If someone wants to run a "commercial" server or whatever, they can establish a separate mapping from client ID to customer. So, it's basically an API key. I will:

• rename it to client_key
• remove it from the URL

from taskchampion.