All API requests must have the following POST fields (rather than headers or in the URL) to authorize. key is your username and secret is a generated hash.

NOTE: These should not be exposed in plain-text where a user could find them.