An API key is issued once, generated by the server and handed to the client, which stores it and attaches it to every subsequent request — typically in an Authorization or a custom header.

The server verifies a key by looking it up against its stored record.

A key in a URL query string ends up logged by proxies, browser history, and server access logs, all in plain text, so it belongs in a header instead.

A key committed to a repository is readable by anyone with access to that repository's history, even after being removed in a later commit, so deleting it isn't enough once it is exposed. It needs rotation: issuing a new key and disabling the old one.