In reply to Melissa.

Hey Melissa,

I understand how on the surface it can seem like the requirement for each install of the plugin to be authenticated via an Unsplash account can seem like there's something sketchy going on, but I can assure you that it comes from a real engineering and security requirement.

We gain nothing from 'inflating' signup metrics — if you've ever used unsplash.com, you can see that we don't care about requiring anyone to signup, as you're not auth walled from any popular features like searching or downloading.

As you know, WordPress uses decentralized installs — unlike lets say Trello, where there's a single centralized application. The developers at Trello can use a single API key for all of their users because the key is hidden behind the Trello servers and can't be exposed to any of the Trello users.

Each installation of WordPress uses its own servers and therefore needs access to its own API key. If every WordPress install were to share the same API key, then there would be no point in having API keys at all, as anyone would be able to open up the Unsplash plugin, read the code and take the API key, and then use the API key for any application they want. Our team then can't protect the service of the API from spammers and DDOS attacks (two very real things we deal with every day) because we can't identify requests to the API by their API key.

Every WordPress install therefore connects to Unsplash to create an API key that is used for that install, so that if the API key starts to do suspicious things, we can notify the owner and resolve the issue without taking down other legitimate uses. This is common practice in any API.