[API keys][1] don't belong to any specific authentication or authorization protocol<sup>1</sup>. We could use `Authorization` header but, as you commented, it would take us to implement our own scheme and protocol. Usually reinventing the wheel in security is a bad idea, so it's good to leave `Authentication` header for well-known authorization standards.<sup>2</sup>.

When I have implemented API Keys authorizations, I wanted to state clearly that the authentication and the authorization protocols were specific of my domain and they didn't respond to any known protocol, hence the custom header. Anyways, it's my own convention that probably only make sense to me.

Worth to mention that some of the largest API providers on the market still  support API key authorizations and some allow us to send the [key in the URL][4].

---
<sup>1: I find this [answer][3] to be very clear regarding API Keys</sup>

<sup>2: However, you will find many articles and opinions (some of them very well [argued][2]) in favour of the `Authorization` header.</sup>


  [1]: https://en.wikipedia.org/wiki/Application_programming_interface_key
  [2]: http://bizcoder.com/where-oh-where-does-the-api-key-go
  [3]: https://stackoverflow.com/questions/1453073/what-is-an-api-key
  [4]: https://developers.google.com/maps/documentation/embed/get-api-key#quick-guide-to-getting-a-key