I would say that an API that requires authorization keys is incomplete if it doesn't provide the tools to manage them securely. How could a service even offer

I would say that an API that requires authorization keys is incomplete if it doesn't provide the tools to manage them securely. How could a service even offer scalability and security if it doesn't support two keys with rotation? It's a "non-trivial problem" because consistent, available, distributed API key rotation is not just hard, it's impossible. (See: CAP) That doesn't solve your problem, but it means that you should take this complaint to whatever API service offering you are using.