The moment your API is public and key-authenticated, you own a small identity system. Every request arrives with a secret. You have to prove it's real, decide what it's allowed to do, let the customer replace it when it leaks, and answer "which key made this call?
Source: [Dev.to](https://dev.to/iurii_rogulia/api-key-management-for-a-public-saas-api-57bk)