The x-api-key is being passed to the HTTP header as a parameter. The HTTP client decides the way it is passed. For instance, if you use curl and also you POST the JSON payload, a request would look like this:
$ curl -X POST -H "x-api-key: theKey" -H "Content-Type: application/json" -d '{"key":"val"}' https://[api-id].execute-api.[region].amazonaws.com