I am studying CartoDB, and am wondering:
To what extent is CartoDB SQL API secure?
From their description about authentication, you can submit entire SQL statements in the URL by appending the api_key to it as follows.
I have seen API keys used elsewhere (e.g. Google Map) for counting visits and charging fees. But I don't quite understand the concept of using API keys in the URL for authentication. How does the security model work here? (Or what's the correct way to make security work?)
A related question is, if CartoDB is set up and used in a intranet (if possible), how is one supposed to configure security for the CartoDB/Postgres instance?