- users can have multiple keys - keys are hashed with bcrypt - each key can have its own expiration - each key can have a contextual comment - authentication via API requests happens with the Authorization header