The trouble with API keys that never expire
A key issued years ago, never rotated, and still valid today is not a convenience. It is a liability nobody has actually looked at in years.
Tag
#authentication
The case against charging extra for basic authentication methods
A header, a bearer token, and a query parameter all authenticate a request the same way. Charging more for one of them is charging for a preference, not a feature.
Send your API key three different ways (and why it matters)
The same key works as a header, a bearer token, basic auth, or a query parameter, so pick whichever mechanism fits the tool making the request.