API Key Security Test Automation

My REST APIs rely on simple API-key authentication, yet that single key opens the door to every endpoint—and at the moment I have very limited visibility into who is using which key, how often, or whether throttling rules are being respected. I need an automated test and monitoring solution that focuses first on Authentication and security setup and, more specifically, the challenges around Monitoring and tracking API key usage.

Here is the current landscape:
• Endpoints are documented, but the docs often lag behind the implementation, so tests must be able to reconcile reality with what is written.
• Several endpoints require multi-step sequences and varied parameter combinations, and I’d like those covered once the core auth flow is stable.
• Versioning is in motion—v1 is live, v2 is staging—so regression testing across versions will matter soon.

Scope of this engagement
1. Build or extend an automated test suite (Postman, Newman, pytest-requests, or similar) that authenticates exclusively with API keys.
2. Include assertions that verify rate-limit headers, 4xx/5xx responses for invalid or expired keys, and any signed-header logic we expose.
3. Instrument the suite—or a companion script—to log each request/response to a time-series store or a lightweight dashboard (Grafana, Kibana, or even a CSV that I can import elsewhere) so I can track usage patterns by key.
4. Provide a concise setup guide so I can run these tests locally and in CI, with clear environment-variable handling for keys.

Acceptance criteria
• All critical endpoints covered with positive and negative auth tests.
• Usage log distinguishes keys and summarizes call counts, average latency, and error rate.
• Tests run green in GitHub Actions (or another pipeline you recommend) with a single command.
• Clear, step-by-step README allowing another developer to replicate the environment in under 10 minutes.

If you have experience hardening API-key flows and turning raw test output into actionable metrics, I’d love to see a short sample or repo link that shows similar work.