I'm hoping to completely redo the way Core handles API keys, so I'll keep this kind of weirdness in mind as something to avoid.