What is the API keys option for REST API authentication?

API keys are typically long, unique, predetermined strings (like a secret token) that a client includes with each request to an API, allowing the server to identify and authenticate the client and grant access based on predefined permissions. This string acts as a credential to authorize the client's API calls.

While some tokens are one-time, API keys are generally reusable and are passed as a secret string, which may or may not be explicitly 'encrypted tokens' in their raw form, although they should always be transmitted over encrypted channels like HTTPS.

API keys are client-side credentials used for authenticating with an API service, not usernames stored in a local router database.

Although API keys *can* be transmitted unencrypted if using HTTP, best security practices mandate transmitting them over encrypted channels (e.g., HTTPS) to protect their confidentiality, so 'transmitted unencrypted' is not a defining characteristic of an API key itself.