@@ -, +, @@ 
---
 .../intranet-tmpl/prog/en/includes/members-toolbar.inc      | 2 +-
 members/apikeys.pl                                          | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc	
+++ a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc	
@@ -57,7 +57,7 @@ 
                 [% END %]
 
                 [% IF Koha.Preference('RESTOAuth2ClientCredentials') %]
-                    [% IF CAN_user_borrowers_edit_borrowers %]
+                    [% IF CAN_user_superlibrarian OR loggedinusernumber == patron.borrowernumber %]
                         <li><a id="apikeys" href="/cgi-bin/koha/members/apikeys.pl?patron_id=[% patron.borrowernumber | html %]">Manage API keys</a></li>
                     [% ELSE %]
                         <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to manage API keys" id="apikeys" href="#">Manage API keys</a></li>
--- a/members/apikeys.pl	
+++ a/members/apikeys.pl	
@@ -52,6 +52,12 @@ if ( not defined $patron or
     exit;
 }
 
+if( $patron_id != $loggedinuser && !C4::Context->IsSuperLibrarian() ) {
+    # not the owner of the account viewing/editing own API keys, nor superlibrarian -> exit
+    print $cgi->redirect("/cgi-bin/koha/errors/403.pl"); # escape early
+    exit;
+}
+
 my $op = $cgi->param('op') // '';
 
 if ( $op eq 'generate' or
--