API keys are just Basic Auth wearing a silly hat.

There's so many better options than just dumping the secret on the wire.