Returns the API key used for Basic Authentication, or an empty string if not available.
Return an empty string once a valid access token exists so that Basic Auth headers are no longer attached to non-token-exchange requests.