I am trying to implement very simple authentication for updating values on my server. Here's the situation:
I have a door sensor hooked up to a raspberry pi. Every time the sensor is triggered ('Opened' or 'Closed'), I send a POST request out to my Digital Ocean droplet at 'api.xxxxxx.com' which points to a restify server. The POST request body contains the sensor state, a time-stamp, and an API key. The RESTify server also has a file called 'constants.js' that contains the same API key. If the API key sent from the RPi is the same as the one in the constants file on my droplet, it allows values to update (latest state/time). If not, it just sends back an error message.
The API key is a password sent through SHA3-256.
Is this scheme okay for what I'm doing? The only thing I could think of is if someone found the endpoint, they might be able to spam requests to it, but nothing else. The API key (on my local raspberry pi and on the droplet) are kept in different files and excluded from git, so viewing git files would not reveal anything.
I don't expect anyone to have access to my droplet or raspberry pi either, so if I set up SSH correctly I don't see how it (the API key in the files) could be leaked either.
EDIT: Forgot to say that I'm using Python on the Raspberry Pi to send out POSTs. The droplet is running a RESTify server (JS).
Well, you are vulnerable to network snooping. If anyone can snoop either of the network links, then they can steal the API key and are free to use your service with it. 
HTTPS on both links would prevent that. HTTPS could also prevent any sort of DNS hijack that could trick the Pi into sending the APIKey to a false host (thus stealing it that way).
Other than that, your API key is your secret that controls access so as long as it is secured in storage at both ends and secured in transit and it's sufficiently hard to guess, you are OK.
Very simple authentication on my own server, is this okay?