API keys are not always (rarely?) intended to be public. Some (most?) solutions are based on always using TLS. In that scenario the API key alone is sufficient

API keys are not always (rarely?) intended to be public. Some (most?) solutions are based on always using TLS. In that scenario the API key alone is sufficient to identify and authorize the user, so the user must prevent the API key from becoming known to others. Some (few?) solutions allow for communication without TLS. In that scenario the API key is usually paired with a shared secret used for signing all messages, so the user is under no obligation to prevent the API key from becoming known to others.