Layer 7 proxies like Cloudflare can read the headers but there seems to be some mix up between API keys sent in URLs and basic auth. The old arguments against it are potential leaks when no encryption is used, credentials sent on each request and the problem with sessions and logouts. You cannot really logout a user.