API clients should be authenticated using both an application identifier – and API key or other shared secret – and a user identifier – an SSL certificate or OAuth token. Even anonymous API ...