You could use an Oauth2 server to generate the entire flow including keys/tokens etc. There are self hosted options like ory.sh or you can get a premium provide

You could use an Oauth2 server to generate the entire flow including keys/tokens etc. There are self hosted options like ory.sh or you can get a premium provider like Okta/AUth0 etc. If you want something simpler, you can just create your own API token for each user but then you will have to build things like regenerate, refresh, expire etc etc. Protocols like OAuth2 make all this standard but adds complexity.