For organizations that must restrict access to application information, it would be helpful if there was a way to restrict interaction with the API in case an admin API key is compromised. For example, restricting which IPs could use the API.