switching to account based keys vs user

account api keys make more sense (keys can either have instance,
partner, or developer access level with varying scopes therein)