Always give the whole response.
Make it possible to reuse key so you don't have to expose your username and password in your app.