1.  API keys and tokens can be more easily replaced / canceled than entire 
  accounts in the case of being breached
  2.  API keys & tokens can commonly have additional access restrictions applied, 
  while it's hard(er) to do that for a whole account
  3.  Likewise, it's easy to think of many-tokens-to-one-account systems, 
  where you encourage users to use different keys for different integrations, 
  which helps lower the surface area of the damage one leaked detail can do
  4.  Many authorization protocols, like OAuth 2, rely on temporary tokens, 
  which are even more helpful in that they guide application integrations towards 
  not hardcoding sensitive details