In both cases, the API key will be passed unencrypted. So both are insecure unless you use HTTPS.
In practice, HTTP header turns out to be a little bit more secure because -
- The url gets stored in browser history
- The url gets stored in access logs on the server side
Aside : A REST API over the web cannot be secured unless you ask the user to login with his credentials. Anybody can easily identify the API key and make requests to your server.
In response to @segfault's comments -
A website user generally does not enter an API key. They enter their user name and password, and this is traded to get the API key or access token as it is typically called.
If you force your users to enter the API key instead of user name and password, well, it'd be secure. But as I said, I haven't seen any serious application do that.
More specifically, I meant "If a backend API expects an API key, and you are making AJAX calls from the browser, and you don't ask the user for some sort of credentials, you are insecure"