An API key is a long opaque string you generate for a client. They send it on every request; you look it up in a database to find the caller. Simple, ubiquitous, and easy to misuse.
1GET /v1/orders HTTP/1.12Host: api.stripe.com3X-API-Key: sk_live_51H...
Alternatives include a bearer header (Authorization: Bearer sk_...) or query string (?api_key=...). Headers are strongly preferred — query strings end up in logs.