If the transport itself is secured (i.e. https) an attacker can not sniff the data. But it might be logged at the server side and the server might later be compromised or some security leak might cause the log files to be publicly visible. Such log files usually contain the URL and they might contain other lines from the headers like User-Agent, Referer and other headers if specified with a custom log format. Thus it might be a bad idea put these API keys into the request header, unless you make sure that they don't get logged.
An argument against putting the key in the request body is that it now would be possible to create a simple HTTP form which includes the key which is easier to be used as a CSRF request. When including the API key as header instead the attacker must be able to do a XHR request and is subject to the restrictions of CORS.
Another reason for not including the key into the URL is that it might get included into the Referer header of a following request. Also the URL's are usually contained in the browsers history so that you have another place which could be compromised. This is relevant only for normal browser requests, i.e. XHR or REST requests done by applications are not affected.
Some explanation about the meaning of "header": sometimes one uses the name 'header' to distinguish the initial part of the HTTP message and the body. In this case the URL is part of the header (request line). Other times one talks about the headers (plural) and means the "field:value" pairs only, i.e. not including the request line with the URL. It is not fully clear for me which meaning is used in the question so I better covered both.