Your platform issues API keys so other services and customers' backends can call your API (no user in the loop). Design it properly: how you generate and store keys, why you never store them in plaintext, how you support scopes and rotation without downtime, rate-limiting and abuse, and when you would use OAuth client-credentials or mTLS instead of a static API key. Explain what to do when a key leaks in a public repo.