[thepratt]

Just thinking out loud here, what about having to attach a key as an attachment?

[SkyLinx]

What kind of key? I am just afraid to make it "complicated" because now it's as simple as sending an email to some address. :)

[thepratt]

You would provide this file for them to download alongside where you show the email address; the file would be equivalent to an API key - should be a symmetric key. It's sort of just swapping out an Authorization header for a file with an expected checksum/contents.

If the barrier is technical abilities, trying to set up public/private keys and/or signing the emails could hinder adoption.