I would suggest using the authorization header to pass the apiKey instead of passing it in the query string. That's what it is there for and it help's to keep api keys out of log files.
I don't think there is anything really wrong with checking for the presence of '$metadata' in the url. You are writing the server side code, and the server owns the URI space, so making decisions based on text in the request url is what the server is all about.
You could use something like,
if (requestUrl.Segments.Last().Replace('/','') != '$metadata')
instead of searching the entire uri string, if it makes it feel less icky!
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…