An API key is a string you hand a consumer and require them to send with every request. It identifies who is calling. That is its job, and it does it well.
What it does not do is secure anything by itself. A key travels with the request; anyone who obtains it can use it. It does not prove the caller is who they claim, it does not scope what they can reach beyond whatever you attach to it server-side, and it does not survive being pasted into a public GitHub repository — which happens constantly.
The real power of a key was never security. It is awareness. Once you know who is calling, you can attach that identity to an account, a plan, a set of rate limits, a bill, and an audit trail. You secure an API for three reasons: to restrict access, to reduce server and bandwidth overhead, and to understand usage. The key is what makes all three possible. Without it you have an anonymous firehose.
So use keys, but be honest about what they are. Pair them with TLS, real authentication for anything sensitive, scoped permissions, rotation and revocation, and monitoring for leaked credentials. The key is the accounting mechanism, not the lock.
