An API Key is a string in a header or query param. It identifies an application (not a user). Used for: rate limiting per app, usage tracking, billing. Must be transmitted only over HTTPS. Not suitable for user auth (no identity). A rotation policy is mandatory.