You do not use the X-API-Key header to access /metrics but, instead, you use the webserver-password=, or webservice.password in case of the YAML format of the recursor.
X-API-Key
/metrics
webserver-password=
webservice.password