Payments/Transaction: Why Account Password & ValidationKey?

[m4rcel]

I have a question to the Payments and their Transactions:
According to this thread, I have to specify my account password and my validation key to be able to create a Transaction.

May question is: Why?

I already have to specify the username and password of the API user of MPWS in the Payments class. Why do I additionally need to set my account password and validation key in the Transaction object? Is it not enough to already know my account from the MPWS credentials?

[m4rcel]

Is this question so hard to answer or why do I not get any response?

[The_Big_Boo]

Oops, I started to write an answer a week ago but forgot to finish it So here is a quick one.

Transactions are done by calling scripts on the master server which need the login, the password and the validation key (as before your first ingame payment) of the payer account. On the contrary, for retrieving data, we're just querying a database replicate on which we can just make select statements.

So transactions are way more critical than other services we're exposing and therefore need this second security layer