Issue scoped API keys for scripts and integrations. Treat them like passwords — anyone with the full key can act as you within its scopes.