that's true, it could be an api key with read-only access to the keys endpoint, and it only gets displayed once