The api-key does not need to be part of the URL, you can also put it in the Authorization header.

edit: typo