API calls allowing both credential locations (http header and query string) for the same Product

We can decide whether the API call passes credentials (user_key or app_id/app_key) in the query string or in the headers. Is it feasible to implement that API calls allow both credential locations for the same Product?