Can I have a collection pass both oAuth2 and api-key?

Hi Ray,

The OAuth 2.0 protocol does not mention the need for an API key. Typically you need to authenticate the request where you exchange the authorization code for an access token by providing the client id and secret as a basic auth header or directly in the request body.

For any request when using OAuth, you will only use the access token and send it in the Authorization header. There is nothing to inherit, apart from using the access token to access any protected resource.

Are you sure you are not confusing the API key with the OAuth token? (no offense intended). It would help if you could add some screenshots to eliminate any confusion.