API keys are typically passed in request headers or query parameters. While simpler than OAuth tokens, they provide less granular permissions. Best practices include rotating keys regularly, restricting keys by IP address or referrer, and using separate keys for development and production environments.
InboxCentral provides API keys through the developer dashboard. Each key can be scoped to specific endpoints and rate-limited independently.