Use stable, opaque identifiers, and keep secrets out of URLs

Resource ids end up in client databases, logs and bookmarks, so they must never change. Treat them as opaque strings in the contract, even if they are numbers today, so you can change how they are generated later.

• Prefer ids that do not reveal volume or order when that matters, such as UUIDs or prefixed random ids (ord_8f3k2).
• Never put tokens, passwords or personal data in a URL. URLs are written to server logs, proxy logs and browser history. Send credentials in the Authorization header.
• Keep URLs free of file extensions (/orders/7.json); use the Accept header for formats.

Sequential integer ids are fine internally, but they make it trivial to enumerate other customers' resources if authorization is ever missing.