But the fact that permissions are not hardened at time of creation is bonkers to me.
Google Maps has one, even. And Stripe.
I like that. Easy to tell if you should keep the key a secret or not.
(Although `pk` always freaks me out. Public or private?! Oh, right, the other one's "secret".)
The only purpose of the keys Maps/Stripe encourage you to publicly put into your website is to guarantee it is talking to _your_ Google/Stripe account not someone else's. Obviously once you put them in your client they are of zero value in helping Google/Stripe identify you. The fact that Google allows you to use the same type of key they also use elsewhere to identify _you_ not _them_ was always incredibly bad design. Google already have the 'Project ID' which would have been the best thing to use.