Design for Internal API Authorization

Question

Hi Team,

I have multiple APIs, some exposed to external users and some for internal consumption only. Exposed APIs are protected using API Gateway and OAuth2.0 based auth. For internal APIs, we are trying to implement API key-based authorization. But, as API Auth Keys are considered as secrets, we have to maintain them in Key Vault. So, if my API wants to call another API, it has to get the key from KV first and use it to call the other API endpoint. This way it may make lot of traffic especially if there are number of internal APIs. And these APIs are a mix of serverless Apps and Kubernetes micro-services.

Can you help with a design pattern or method to securely handle authorization for internal APIs.