Redirect API calls from HTTP to HTTPS

This article argues that APIs should not redirect HTTP requests to HTTPS as it hides errors and exposes sensitive data in plaintext. Instead, APIs should either disable the HTTP interface entirely or return clear error messages for unencrypted requests to ensure security and help developers quickly identify and correct mistakes. The author also recommends revoking any API key that arrives over plain HTTP on the spot, and OpenAI and Anthropic have already switched their APIs from redirects to errors. An issue opened on 2024-05-30 in GitLab’s tracker proposes the same for the GitLab.com API, including immediate token revocation, while conceding that both would be breaking changes.