Actions on API keys shoudl be logged and auditable (i.e. who creates the API keys, who revokes, etc).