It's incredibly common. See Stripe for example https://stripe.com/docs/api/authentication

Authorization: Bearer <API Key>.