How secure do you want it to be? Also - what are the chances your users will leave API keys in their source code repo or pass them around to other devs on thei

How secure do you want it to be? Also - what are the chances your users will leave API keys in their source code repo or pass them around to other devs on their team? A lot of the reasoning around API security depends on who your users are and what type of protection you want, or need contractually, around the data behind your API. There are likely going to be OAuth libraries you could use, everything should be behind HTTPS.