Both scenarios are supported and the decision to manage authentication is done by a single API key for all suppliers. Different API key for each supplier is up to the booking platform and will depend on their own security policies and practices.