API keys are basically tied to a user account, so the permissions for the key match the permissions for the user.
If you create a user with read-only permissions for a specific space, then the API key(s) for that user will be limited to read-only operations for that space.
3 Likes