We moved ~60 of our own agents off one shared API key. Here's what it took

Last week about 113 of our scripts and agents read our systems with one master key. Only 2 went through a gateway. Here's what moving them to one key per agent taught us: Writing down what each agent actually calls was the slow part. We ended up with 60 separate allow-lists; six of the first 25 turned out to be identical and were merged. Most agents only needed reads. Each list names exact routes with no wildcards, and anything outside it gets a 403. Every call now needs a short-lived run (60 seconds, one call), so a runaway loop can't keep hitting the API. Retiring the master key had to come last. We turned it off only after a scan of every script and scheduled job found no reference to it, and each agent's own key had carried real traffic. Curious how others handle this: per-agent keys, a proxy, or just trusting the prompt?