The likes of AWS and Github have scoped API keys for that purpose. But good luck trying to convince a non-tech company to implement something like this.