Short answer: treat an API key as a credential bound to one tenant identity, an explicit permission set, and a finite validity window. Store only a verifier, check revocation on every request, and write the resolved tenant and key identifiers into immutable usage events. That is the smallest design that keeps a marketplace request attributable when invoices depend on it. The deciding constraint is billing accuracy. A key that merely proves "someone knows this secret" is too vague. If two sell...