Is it safe to send admin credentials to rest API

Question

I am getting data from magento2 REST api. I send admin credentials to get the token then I use the token to get the data and everything is working fine.

Is it a safe way to do that? Should I create another user with specific permissions for accessing REST api on magento? What is the recommended way to do it?

I am using the below code:

    //Authentication rest API magento2
    $adminUrl='http://domain.com/index.php/rest/V1/integration/admin/token';
    $ch = curl_init();
    $var = 
    $data = array("username" => "username", "password" => 'password');                                                                    
    $data_string = json_encode($data);                       
    $ch = curl_init($adminUrl); 
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");                                                                     
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);                                                                  
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);                                                                      
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(                                                                          
        'Content-Type: application/json',                                                                                
        'Content-Length: ' . strlen($data_string))                                                                       
    );       
    $token = curl_exec($ch);
    $token=  json_decode($token); 
    $ch = curl_init( "http://domain.com/index.php/rest/V1/products?searchCriteria[pageSize]=10&fields=items[id,name,sku,price,status]" );

    $curlOptions = array(
        CURLOPT_CUSTOMREQUEST  => "GET",
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => array(
            "Content-type: application/json",
            "Authorization: bearer ".$token
        )
    );

    curl_setopt_array( $ch, $curlOptions );

    $response = curl_exec( $ch );

    return $response;  

Answer 1

There are two aspects here:

1. How safe is the transport?

   in your case, not safer than a postcard, because you use HTTP and anybody between your device and the server could inspect every detail of request and response.

   Solution:

   1. Add an SSL certificate if you don't have any yet. you can get a free one at https://letsencrypt.org/ - this is also important for the security of your customers!
   2. Use https://example.com instead of http://example.com for your API calls.

2. Should you use a dedicated API user?

   It's generally a good rule of thumb to only allow as much as necessary. So, yes you should create one or more separate users for API access that receive just as much permissions as they need.