Add nonces to API key issuing and revoking