docs: protected String getApiKey(HttpServletRequest request, QueryMap queryParams) {
          String apiKey = request.getHeader("X-API-Key"); //$NON-NLS-1$
          if (apiKey == null || apiKey.trim().length() == 0) {
              apiKey = queryParams.get("apikey"); //$NON-NLS-1$
          }
          return apiKey;
      }