I've written an article about api key authentication for api controllers on Umbraco 10 and up: https://dev.to/d_inventor/how-to-secure-your-umbraco-api-controller-with-an-api-key-3ia2