The purpose of API keys & tokens are to bring user authentication details out of every request. This is helpful in many scenarios: 1. API keys and tokens c

The purpose of API keys & tokens are to bring user authentication details out of every request. This is helpful in many scenarios: 1. API keys and tokens can be more easily replaced / canceled than entire accounts in the case of being breached 2. API keys & tokens can commonly have additional access restrictions applied, while it's hard(er) to do that for a whole account 3. Likewise, it's easy to think of many-tokens-to-one-account systems, where you encourage users to use different keys for different integrations, which helps lower the surface area of the damage one leaked detail can do 4. Many authorization protocols, like OAuth 2, rely on temporary tokens, which are even more helpful in that they guide application integrations towards not hardcoding sensitive details Just a few reasons & justifications off the top of my head.