# Should the password be plain text when creating a user through the API?

**URL:** <https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024>\
**Category:** Development\
**Created:** [July 11, 2017, 11:33pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024 "2017-07-11T23:33:11Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![mikeredick](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@mikeredick](https://meta.discourse.org/u/mikeredick)\
**Post date:** [July 11, 2017, 11:33pm UTC](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024/1 "2017-07-11T23:33:12Z")

</div>

I’m creating a small windows application that will use Discourse as the SSO provider. The first step in that chain is allowing the app to create a user through the Discourse API.

I’ve got that working, however it seems that the password for the user is passed in plain text and I’m wondering why that is? It seems like that could be a security issue… is the thought just that people should use SSL and that’s good enough to protect the password?

---

_[View the full topic](https://meta.discourse.org/t/should-the-password-be-plain-text-when-creating-a-user-through-the-api/66024)._