but if its not really a big deal security wise, you could just do this on the normal API key too ?