Thanks for the help so far 
I actually read something about your idea with M2m client somewhere in the community, but that sounds so weird/wrong and not scalable.
If it turns out not to be possible, then I will have to roll my own API key implementation 