For both cases, what you want to have is a central account that you authenticate to using the key, and that account uses OpenSocial/OAuth-like protocols to grant access to separate services.

That’s how those central teams manage to revoke keys easily.