Passing coinbase api key in URL for authentication not secure?

[kbitcoinc]

I am a newbie to this forum, i had wanted to post this thread under "Development".

I have started to look into coinbase api, and i found this key authentication URL format:

   https://coinbase.com/api/v1/account/balance?api_key=YOUR_API_KEY

Is this good practice? the API_KEY will grant caller privilege to buy, sell, and send payment, which means
anyone who know it can empty your bitcoins, as well as your bank account linked to it? (thankfully up to
the daily buy limit imposed by coinbase). I am afraid this URL can get sniffed, or stored in some logs
on the server side. I want to get some opinions with security experts out there, and if warranted, i will
ask coinbase to disable people from doing that. I have heard on Reddit that some ppl have already lost
bitcoins and $$ from mishandling this Key. Passing it as part of URL is probably a big way to expose it
to the world.

[LastElb]

Hi,
what I can answer for sure is sniffing:
As you use https (so SSL) someone can capture and decrypt the traffic (and URL) only when an attacker starts a "man in the middle" attack (the attacker basically hacks in the connection between you and the targeted server. Then he fakes an SSL certificate for you and all encrypted traffic goes via the "man in the middle" to the original server. The attacker can decrypt and modify any data send from you and pass them to coinbase). Man in the middle attacks are very targeted and you have to generate/buy a certificate your computer trusts (otherwise the connection will be refused). If your german, the wikipedia article for man in the middle attacks has an good article and extra part for MITM-SSL-Attacks (the english one lacks at this point).
The API-Key is saved on coinbase's server none the less. They need to check if the api-key is valid and connect them to your account. So if they get hacked, you (and others) can be fucked (but hopefully they encrypted the keys on their servers).
To sum it up: If some hacker witnesses that your trading BTC and wants to hack in - he can that. But if your using anti spy- and malware programms you shouldn't be on the radar.