I have a hundreds of users and I going check online list every 15 seconds, so I need a fast way to get online list.
Users Presense plugin give an apportunity to get status of only one user. I think that many HTTP requests (for each user, each 15 seconds) will require a lot of server resources.
If you want it to be public available, add the following property to your system properties in the admin console: plugin.onlineUsers.list.disableAuth and set it to true.
Be aware that you have to restart the server in order to enable this setting. Maybe a plugin restart is also possible, but I didn’t try that.
If this setting is not specified, the standard admin login is required to get the list. I think this is openfire’s default behaviour and I didn’t want to change it to another (with e.g. the secretKey as you proposed).