diff --git a/Bugzilla/App/Plugin/Login.pm b/Bugzilla/App/Plugin/Login.pm
index 55c845c507..2712565dad 100644
--- a/Bugzilla/App/Plugin/Login.pm
+++ b/Bugzilla/App/Plugin/Login.pm
@@ -107,7 +107,15 @@ sub register {
 
       # For api requests, we check for the api key in the header
       if ($usage_mode == USAGE_MODE_REST || $usage_mode == USAGE_MODE_MOJO_REST) {
-        if (my $api_key_text = $headers->header('x-bugzilla-api-key')) {
+
+        # Deprecated fallback for the legacy ?api_key=<key> query parameter,
+        # same as the legacy WebService dispatcher (see
+        # Bugzilla::WebService::Util::fix_credentials). This is a
+        # deprecation-pending stopgap, not a first-class supported method.
+        my $api_key_text
+          = $headers->header('x-bugzilla-api-key') || $c->param('api_key');
+
+        if ($api_key_text) {
           if (my $api_key = Bugzilla::User::APIKey->new({name => $api_key_text})) {
             my $remote_ip = $c->tx->remote_address;
             if (
diff --git a/docs/en/rst/api/core/v1/general.rst b/docs/en/rst/api/core/v1/general.rst
index 252ae63735..903eddc652 100644
--- a/docs/en/rst/api/core/v1/general.rst
+++ b/docs/en/rst/api/core/v1/general.rst
@@ -114,8 +114,10 @@ Send only one authentication method with each request. BMO does not combine
 credentials or choose the strongest method when more than one is supplied.
 
 Most resources have been migrated off the legacy authentication path onto BMO's
-native REST framework, which accepts only a cookie, an ``X-Bugzilla-API-Key``
-header, or an OAuth2 bearer token. Legacy ``Bugzilla_login`` and
+native REST framework, which accepts a cookie, an ``X-Bugzilla-API-Key``
+header, or an OAuth2 bearer token (plus the deprecated ``api_key`` query
+parameter described in the warning below, kept only as a stopgap for
+undiscovered callers). Legacy ``Bugzilla_login`` and
 ``Bugzilla_password`` credentials are **not** accepted on these resources, even
 though the old WebService dispatcher underneath BMO still supports them for
 resources not yet migrated (currently ``Bug``, ``Group``, ``Product``, and
diff --git a/qa/t/rest_native_login.t b/qa/t/rest_native_login.t
index d798998654..6b23173a9c 100644
--- a/qa/t/rest_native_login.t
+++ b/qa/t/rest_native_login.t
@@ -49,6 +49,13 @@ $t->get_ok($url . $endpoint)->status_is(401);
 $t->get_ok($url . $endpoint => {'X-Bugzilla-API-Key' => $api_key})
   ->status_is(200)->json_has('/result');
 
+#
+# 2a. Deprecated fallback: an API key passed as the ?api_key= query parameter
+#     also works (bug 2073282), same as the legacy WebService dispatcher.
+#
+$t->get_ok($url . $endpoint . '&api_key=' . $api_key)
+  ->status_is(200)->json_has('/result');
+
 #
 # 3. Authentication via the login cookie + Bugzilla_api_token parameter works.
 #    This is the mechanism the web UI (Bugzilla.API) uses, and is the path that