What is the API keys option for REST API authentication?

An API key is a unique, predetermined string (or hash) that acts as a secret token, passed from the client to the server in each request (typically in a header or query parameter) to identify the client and authorize access to the API.

API keys are generally persistent and reusable for a given client, not typically 'one-time encrypted tokens'; while they should be transmitted securely (encrypted via TLS), the key itself isn't a 'one-time encrypted token' in the OAuth sense.

For security, API keys, like all sensitive credentials, should always be transmitted over an encrypted channel (e.g., HTTPS/TLS) to prevent interception, making transmission 'unencrypted' an insecure practice.

An API key is an identifier for an application or client, distinct from a user's username, although it may be associated with a user or service account on the server.