# What should password field be? **URL:** \ **Category:** Development\ **Created:** [21.Ноябрь.2016 00:57:47 UTC](https://meta.discourse.org/t/what-should-password-field-be/53167 "2016-11-21T00:57:47Z")\ **Posts on this page:** 1\ **Showing post:** 5
**Author:** ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)\ **Post date:** [04.Декабрь.2016 06:15:19 UTC](https://meta.discourse.org/t/what-should-password-field-be/53167/5 "2016-12-04T06:15:19Z")
Just to keep all the discussion in one place, I’m replying to your message here. > [@On another topic](https://meta.discourse.org/t/53761/1): > > I have created an Android App for a private discourse server. I’m having issues with authentication. How does the “signin” work? What would the flow be, using the API? I have a current flow, but not sure if it is correct. Here is what I do: > > /session?api\_username=&api\_key= (With login and password as part of POST parameters.) If you use your master api\_key in your android app then you have serious security issue. Developers can decrypt your app and can get api key easily. > [@On another topic](https://meta.discourse.org/t/53761/1): > > I have been investigating using Google Firebase as the Auth SSO, but I’m not sure how to create the user in the Discourse forum after it was created in the Firebase database. Firebase will return `IdToken` on successful login. You should send this to your server and validate it using one of the methods in [Verify ID Tokens  |  Firebase Authentication](https://firebase.google.com/docs/auth/admin/verify-id-tokens). If it successful you can generate user api\_key on server itself and send to android client. Also you can store the `user api_key` (not master api\_key) on Firebase behind auth rules and retrieve anytime. --- _[View the full topic](https://meta.discourse.org/t/what-should-password-field-be/53167)._