Does it matter who generates DAP API client keys?

[bliszewski]

I know that you can only see and manage the keys that you generate within the Identity Services, so they must be associated to the user. But do they also inherit the Canvas User's status, roles, and permissions? Or, once generated, are they independent credentials with their own expiration and all with the same (full) access?

Early on, perhaps in one of the blog posts, I believe it was mentioned that a User needs particular Canvas permissions to access the Identity Services and generate keys. But otherwise the documentation seems to gloss over the management of these keys. It's not clear if data may be filtered or restricted (intentionally or otherwise), or if it may be more appropriate to use "service accounts" to generate and manage them rather than individual admins.

[IanGoh]

I don't believe it has anything to do with "you" per se.

[reynlds]

We have a couple of "full institutional admins" that can perform this. I believe the Identity portal will kick you out unless you have a minimum level of permission, essentially not allowing you to even attempt to generate a credential. However, it would be great to see any details on this, especially the actual entitlements needed (if it's known). I can only see this enhancing administration...