Ask HN: Why do API's have to be so complicated?

Why do API's have to be so complicated when identifying who's using the API? OAuth and all these other authentication methods just to use an API seems like too many loops to jump through just to use your API. What's wrong with a simple key passing to identify who's using the API? Maybe even lock that key to a domain to check on referral from so that nobody can steal someone else's key and abuse it?