So I'm planning to use APIs for my host app. But the APIs are built such that it requires a sessionkey for every request.
So my question is, how would I dogfood my API? Cause, apparently I'm thinking in the line of creating a "special" key for my host app (cause it makes no sense to request for a key for my own use), but, anyone inspecting the headers of the request could find this key and literally use it and bypass requesting their own keys.
Maybe there's a best practice for dogfooding our own API without a special key or someway to differentiate whether the request is coming from the host app or the public.
I couldn't use IP to differentiate too, cause the public could be using the same server to call the APIs. That's just the way it is, and is a one of the constraints to keep in mind.