Scoped api key inherits permissions of the parent key. So you have to enforce the collection rule for the parent api key.