If it were possible for an admin to define multiple org-specific keys that were either full admin or read-only, it'd address many of my wishes.
As it stands I (or another admin) need to create multiple logins, each needing a different email alias, each needing TFA set-up. If the admin changes, it all needs ripping up and redoing. It's not a good solution with multiple orgs.
The API authentication process starts with the key, clearly the logic to look-up a key is there.
That's the point at which the access privileges for that key are established it doesn't seem a huge complication to make those privileges those of the key rather than of the owning admin.
If it really must be based on a user ID, then let admins create multiple aliases that each have only one editable thing in their user profile: the API key (everything else just inherits from the parent ID.)
The login email address could use a syntax like n!real.email@real.com where the n is a Dashboard generated 'alias ID' followed by a '!', so we don't need to create and manage real email aliases, there's still only the single admin email - this alias isn't ever used as an email address, the ! is never going to get routed as a bang path 😀
Then we just add the alias ID as the admin and it can have it's own org access settings.
It's a bit of a 'bag on the side', but again it's something that feels it should be possible as a simple extension.
