We'll respond shortly.
“What’s a good way to disable/enable features in an application? Sometimes our client needs to deploy, but not enable all the currently in progress features.”
It was recommended that you make branches in your source control manager for features and avoid global variables to use and switch on in your code.
“How are others authenticating requests to their API?”
One team uses Mashery to manage the public facing connection points to their API. Mashery manages the developer API keys, authentication, response caching and metrics. So far it’s worked well for them.