API keys can be passed as the X-API-Key attribute in request headers and allow authenticated access to API methods for downloading data. OAuth is still required for access by commercial software or where user identification is more important such as for submissions or to access private data.