A typical API authentication usually rely on a pair of API ID + SECRET, my question is: if the API ID is unique and randomly generated and is considered strong enough (e.g. SHA512), why a SECRET is even needed?
What if, I created an API only need a API ID for authentication, what would be the drawback, especially in term of security?
Some people might say, it is easy to revoke the SECRET without changing API ID, but this does not sound since if you need to update the SECRET, you need to modify the config/source code as well.
Internally the API program can still have some unique ID to identify the client, but this information does not need to expose to the client code, just use a single ID is enough, right?
Actually I would considered using a single API ID is more secure - since when you change , it is more hard to identify the client (as there is no constant API ID)