[bombcar]

There’s a cheapish middle ground - generate unique URLs for each downloaded, which basically embeds a UUID “API” key.

You can paste it into a curl script, but now the endpoint can track it.

So not example.com/file.tgz but example.com/FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8/file.tgz

[hyperdimension]

Yeah, but everyone knows that one. ;)

[account42]

Everyone also knows the API keys that are used for requests from clients (apps/websites/etc.). ;)