Why? Isnt the API key scoped to a project and specifically made for this?

Are you confusing this with an OAuth token or something?

Until astra goes bonkers and use the tpu for days