How are API keys used for REST API authentication?

API keys are a simple authentication mechanism where a client sends a unique, predetermined string (the API key) to the server with each request. The server then validates this key against its stored list to grant or deny access. This method is straightforward and commonly used for identifying the calling application or user, often for rate limiting or basic access control. Option 'a one-time encrypted token' describes tokens like JWTs, which are more complex and often include expiration and other claims, unlike a simple API key. Option 'a credential that is transmitted unencrypted' is incorrect because while API keys can be transmitted unencrypted, they should ideally be sent over HTTPS to protect them in transit. Option 'a username that is stored in the local router database' describes a local user account, not an API key used for programmatic access to a REST API.