I think the API keys are fine by themselves, I think the willingness to accept the API keys only shows that you have a commitment to keeping their data secure.

I think the API keys are fine by themselves, I think the willingness to accept the API keys only shows that you have a commitment to keeping their data secure. You could offer a "free" consultation service to show people have to make the API keys so that if they do become lost or don't know what they are doing, you can guide them and they know that your first priority is not only their service, but the security of their data.