Keys and tokens sound like OAuth. You will need to understand the roles that each party plays in OAuth (are you the application or the identity provider?), and

Keys and tokens sound like OAuth. You will need to understand the roles that each party plays in OAuth (are you the application or the identity provider?), and configure/use Flask appropriately. I'm not that familiar with Flask, but a cursory search says that it supports some of OAuth. Or you might say 'screw it', and use HTTP Basic auth with HTTPS.