I'm working on an API that lets users pass in a public key (sort of like how Supabase has an anon key), but I'm not sure the best way to go about passing it into the API?

My 3 main thoughts were: pass in to request body, pass in Authorization header (like a secret key), or pass in a custom header (like x-public-key).

I wanted to get some thoughts here, since I'm fairly new to this