I am writing an application in Java that will be using SHA-1 HMAC message authentication. From what I understand, a connection over HTTPS is considered secure enough to share a secret key in plain text, and there is little added benefit to hashing the key before sending it from the client to the server.
So, my implementation would have to share a secret key when the first connection is made. After that, the client would send an API key along with the message that would identify the client and allow the server to look up the correct secret key.
For more information on the approach that I want to use, I am following this guide (Gary Rowe's Multibit Merchant).
The goal is to authenticate the client on subsequent connections.
Is my assumption correct that I can safely send the secret key over HTTPS on the initial connection?