an alternative would be to use get-or-create-key with the profile permission here directly..