title: What is the best way to have Authenticate for a Web Service
body: <p>We have a .NET web service API. Currently, people use the SOAP definition to consume the API, because we require authentication through a custom Authentication element in the SOAP header. Works perfectly. fine.</p>
  
  <p>SOAP requires the request to be a POST. We want to allow the users to use a the GET verb (so it can be cacheable).</p>
  
  <p>So, what's the best way to offer a simple GET API (doesn't have to be a webservice!) that also offers authentication?</p>
  
  <p>example API route:</p>
  
  <blockquote>
    <p><code>http://www.blah.com/api/Search?query=Foo</code></p>
  </blockquote>
  
  <p>Is this an acceptable and common practice?</p>
  
  <blockquote>
    <p><code>http://www.blah.com/api/Search?query=Foo&amp;Key=&lt;some guid&gt;</code></p>
  </blockquote>
  
  <p>NOTE: I also don't want to implement SSL nor install extra software or plugins in IIS, etc. etc.</p>