title: How do API Keys and Secret Keys work? Would it be secure if I have to pass my API and secret keys to another application?
body: <p>I am just starting to think about how api keys and secret keys work.  Just 2 days ago I signed up for Amazon S3 and installed the <a href="http://www.s3fox.net/" rel="noreferrer">S3Fox Plugin</a>.  They asked me for both my Access Key and Secret Access Key, both of which require me to login to access.</p>
  
  <p>So I'm wondering, if they're asking me for my secret key, they must be storing it somewhere right?  Isn't that basically the same thing as asking me for my credit card numbers or password and storing that in their own database?</p>
  
  <p>How are secret keys and api keys supposed to work?  How secret do they need to be?  Are these applications that use the secret keys storing it somehow?</p>