Picture it: your API is a day from launch. You have a decision left that looks small. What do you call the header that carries your key? x-api-key, X-API-Key, X-Api-Key. Someone on your team says it doesn't matter. The apis.io headers section says it might.
That section counts every header declared across 159,590 specification files from 27,956 providers. The clearest finding sits at the top. Authorization comes first, declared by 1,381 providers, and it is an IANA-registered header. Second is x-api-key, at 798 providers. It is spelled seven different ways, and it is not registered with IANA. In the post's words, the second most declared header in the API economy is a convention nobody standardized.
The scan found 6,666 distinct names. A header earns its own page if IANA registers it, a regulation reaches it, or 25 or more providers declare it. That produces 308 pages and leaves 6,514 names in the tail. And 97 headers are spelled more than one way, so your naming question is one a lot of people have answered differently.
The rest of the table is worth a look before you commit to anything. Retry-After is declared by 329 providers, in three spellings, and it is reached by PSD2. Idempotency-Key has 169 providers and four spellings, and it is not registered. X-RateLimit-Limit has 130 providers and four spellings, and the post calls it the older form. The newer RateLimit-Limit has 32 providers and three spellings. Then the lifecycle rows: Sunset is declared by 10 providers and Deprecation by 7. DPoP shows up for exactly one, SIMBA Chain.
The author says the lifecycle rows are the ones he would act on. 329 providers document how to slow a client down, while only 10 declare the header that says an endpoint is going away. Agents lean on that signal more than people do, because nobody is reading the changelog on their behalf. If your API will retire a version someday, this is the line that applies to you.
Before you read too much into any count, the post asks you to remember that counts measure contracts, and contracts have authors. X-Amz-Date shows 98 providers, but 94 of them are Amazon or AWS services. X-WP-Total shows 121, which reads as one platform's default output and not 121 separate decisions. x-v shows 61 because Australia's Consumer Data Right mandates it, and its declarers run through banks and energy companies. A provider count can mean a market choice, one platform's output, or a legal requirement. The section marks the regulated headers, 33 in all, so you can tell which is which.
There is a blind spot too. 156 IANA-registered headers were never observed in any contract. Sec-GPC, Clear-Site-Data and Permissions-Policy are reached by regulation and show zero, but they travel at the browser and edge layer, where an OpenAPI file rarely looks.
Then the post turns on itself, and this is the part to trust it for. The counts only include header parameters and headers: mappings. An API that declares bearer auth only through securitySchemes sits outside the Authorization number, so 1,381 is a floor, and x-api-key has the same limit. The author says the catalog should count security schemes too, or state the limit on those pages.
Two data bugs turned up while writing it. Six headers carry no category, including X-Correlation-Id at 34 providers and api-version at 29. The landing page builds its groups by category, so those six have pages but appear in no group. And Idempotency-Key is labeled a response header while x-idempotency-key is labeled request, even though they do the same job.
So what do you do on Friday? The post's takeaway is short. Use one spelling. Declare Sunset and Deprecation. Put your auth in securitySchemes as well as your docs, so tools that count the contract can see it. The full data is at apis.io/headers/.
Read the original: https://apis.io/2026/11/05/x-api-key-has-seven-spellings-798-providers-and-no-iana-registration/