Scope tokens to the action, not the identity

A common API-key mistake is issuing a token that means “this user” and then letting every endpoint decide what that implies. Prefer tokens scoped to the action you intend: read invoices for tenant X,