We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple API Key based authentication.
I would like to get some inputs to understand what are the different precautions we should consider to host such APIs as provider.
Consumer have their interface exposed as browser based client (web page) & they would like to call the APIs directly from client side browser app (not from web server). I heard it is existing pattern & if data is not sensitive it can be supported. But I like to make sure that all possible precautions from security perspective has been taken.