How do you implement API key management for a public-facing microservices platform?

Tests whether you know keys should be hashed at rest, prefixed for fast lookup, and support rotation and per-key rate limiting.