How does that stop the operator from watching the logs, and stealing all my data?
Can you please elaborate on what you mean by time-boxing and how you achieve it? I'm assuming it means to assign a time scope to a key and then revoke it's access outside of that time period. This would require access to the API authentication methods, correct? Otherwise, for API's that you don't have backend access to (e.g., GitHub API) you should just generate a token for testing and manually delete it when you are done?
They mean to assign an expiration date to your tokens. Then when you're done testing, still revoke the token, even if you haven't reached the expiration date.