This would allow us to provide the same increased limits that we provide for logged-in users of the client application. See T182182 for example.

Implementation details to-be-determined, but we might explore Symfony's AuthenticatorInterface.

Ideally it would work where clients only need to provide their own unique API key. One simple way of doing this is to provide a new web endpoint such as xtools.wmcloud.org/api/auth that will require you to login with OAuth. Once logged-in, it will give you your API key that is unique for that user. Store it in the Trove db, and check against that on each request (and maybe cache active API keys for performance, or something).

Unauthenticated use of the API should still be allowed, but subject to the same limitations it has currently.