I've never used Facebook's API but I assume each server/app that wants to access it has an API key specific to that server/app. Couldn't Facebook just revoke th

I've never used Facebook's API but I assume each server/app that wants to access it has an API key specific to that server/app. Couldn't Facebook just revoke the key? Or change its permissions?