The Kinds of Authentication

Four kinds, in rough order of how often you meet them.

None. Many public archives need nothing at all.

A key in a header, such as X-API-Key. The common case.

A bearer token, sent as Authorization: Bearer ….

OAuth, a flow that gets you a token on behalf of a user. Worth learning when you need it and not before.

Some APIs put the key in the query string. Avoid that where you have the choice: URLs end up in server logs, browser history and referrer headers, and a secret in a URL is a secret in all of those places.

A key identifies you, and that is the point. It is how the provider counts your requests, applies your limit, and turns you off if you misbehave.

That also means a leaked key is used in your name. The limit it burns through is yours, and if it is attached to a paid account, so is the bill.