I'm designing an API, and I need to authenticate each request with a user. The simplest way to do that is to provide an API key to each user on their "My account" page, that they could regenerate at any time.
Then, our users can either include it when they design their consumer apps, or the apps they use can ask the user for their API key.
The API would only be accessible via HTTPS requests that include a header with the user's API key as value.
Is this a bad idea?