Architecture for client / server authentication / api-key

Eh the definition is fuzzy, but I generally use it in such a way that each request is entirely stateless.

I think it’s just because adding cookies complicates ‘some’ client libraries (not so much anymore, but back in the day it definitely did).

Not at all, if anything cookies are more performant. I really think it’s just because so many older http client libraries didn’t have cookie support (but as stated, nowadays that’s not really an issue anymore, so its an old holdover).