Ah, that's fair

I guess the trade-off is here that the api key cannot then be retrieved from a GUI either (because the server doesn't actually know the original key!) .. from a UX perspective, most companies show your active keys in a GUI with ability to selectively remove or replace.

Though I can't think of a mainstream API that hasn't let me retrieve api key from GUI