Any endpoint can require an API key by turning on Requires an API key in its settings. Callers then need to send Authorization: Bearer <key> or the request is rejected.
Creating a key
From your API project's Keys & Secrets tab, create a new key and give it a label. The full key is shown exactly once, right after creation, copy it somewhere safe immediately. After that, only a hash of it is kept, we can't show it to you again, even on request, only revoke it and issue a new one.
Scoping a key to specific endpoints
By default, a key works on every endpoint that requires one. When creating a key, you can instead pick specific endpoints it's allowed to call, useful for handing a limited key to a third party without giving it access to your whole API. Keys created before this option existed keep working on every endpoint, exactly as before.
Revoking a key
Delete it from the Keys & Secrets tab. Any caller still using it immediately starts getting rejected, there's no grace period.
Tip: Give each key a descriptive label naming who or what uses it — with several keys issued over time, that's the only thing that tells them apart later.