Understanding how to properly implement API Keys for only third parties

Struggling to understand exactly how this should be pieced together. I have an API that I'm currently using on my frontend. I'd like prevent users from calling certain endpoints unless I've issued them an API key.

Users will be sending the key in the authorization header. I then have the keys stored in a database with different possible options.

I'm trying to understand what the best method would be to exclude the main site from being affected or needing to provide an API key. It's very possible I'm going about this the wrong way.

func APIRequestMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		hostIP, _, err := net.SplitHostPort(r.RemoteAddr)
		if err != nil {
			logerr.FromError(err)
			hostIP = r.RemoteAddr
		}
		if string_util.StringInArray(&hostIP, []string{
			"my.clients.ip?",
		}) {
			next.ServeHTTP(w, r)
		}
		auth := r.Header.Get("authorization")
		type tokenDetails struct {
			Token      string
			Expires_at time.Time
			Rate_limit int
			Enabled    bool
			Created    time.Time
		}
		var details tokenDetails
		err = sqlx.Get(database.AccountDB, details, `Select * from keys where token = $1`, auth)
		if err != nil {
			request_util.InvalidTokenResponse(w, r)
			return
		}

		if details.Expires_at.Before(time.Now()) {
			request_util.InvalidTokenResponse(w, r)
			return
		}
		if !details.Enabled {
			request_util.InvalidTokenResponse(w, r)
			return
		}

		// Track # of requests
		// if currentRequest > details.Rate_limit {
		// 	request_util.InvalidTokenResponse(w, r)
		// 	return
		// }
		next.ServeHTTP(w, r)
	})
}

As a side question, when tracking the number of requests to prevent a user from hitting a rate limit, should I be storing the # of requests they make directly in the database or just in memory?

Something like this would work:

var allowedPaths = map[string]bool{
	"GET/abc": true,
}

func APIRequestMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if _, ok := allowedPaths[r.Method+r.URL.Path]; ok {
			 next.ServeHTTP(w, r)
			 return
		}
		
        auth := r.Header.Get("authorization")
        type tokenDetails struct {
            Token      string
            Expires_at time.Time
            Rate_limit int
            Enabled    bool
            Created    time.Time
        }
        var details tokenDetails
        err = sqlx.Get(database.AccountDB, details, `Select * from keys where token = $1`, auth)
        if err != nil {
            request_util.InvalidTokenResponse(w, r)
            return
        }

        if details.Expires_at.Before(time.Now()) {
            request_util.InvalidTokenResponse(w, r)
            return
        }
        if !details.Enabled {
            request_util.InvalidTokenResponse(w, r)
            return
        }

        // Track # of requests
        // if currentRequest > details.Rate_limit {
        //  request_util.InvalidTokenResponse(w, r)
        //  return
        // }
        next.ServeHTTP(w, r)
    })
}