I want to know how much secure is to store private key in the keosd and retrieve via http request and then use these keys in application for trasact an action ? and i don't want to force users to use scatter because of bad user experience. I want a possible secure solution for my application to save keys in which i create accounts for users from generated keys stored in keosd and then signed transaction from these keys. thank you help in advance
When storing in keosd, you can take preventive action to keep the keys out of your console's logs. Also, you can sign transactions in a cold-storage way so that you're only broadcasting the signed transaction.
Not sure what you mean by bad user experience on Scatter, I think it's the bee's knees.
Why would you want to generate the keys yourself? I wouldn't trust any application to do that. Maybe I'm missing something.
If you really want to create the keys, then I would suggest creating a customer permission level. A user could then add this customer permission level to their account and they could agree as to what the permission level can do in a Ricardian contract.