rest - Accepting api keys in HTTP headers or JSON POST data -

i have http json endpoint localhost:8000/resource/ takes json data input , returns json output. adding api key based authorization endpoint. there 2 ways accept api key @ endpoint:

method a: in request headers

example python code:

import requests headers = {    'api-key': '<my-api-key>', } r = requests.post('http://localhost:8000/resource/',                    json={'input': <value>},                     headers=headers) 

method b: in json data itself

example python code:

import requests r = requests.post('http://localhost:8000/resource/',                     json={'input': <value>, 'api-key': '<my-api-key>'},) 

i notice method a being adopted. there wrong latter approach in api key passed along other json data?

i think has clarity, api key isn't relevant input, it's form of authorization.

large frameworks deal routing , such able filter based on specific headers, , cumbersome filter based off of specific form of input in request body require user intervene , obtain value it. headers simpler, , suffice simple data fit in hash-table.