Keys that let outside programs work with this system without a user signing in.
A key is shown once
The full key is displayed once, at creation. After that only its first few characters are visible; the key itself is not stored, only a hash of it.
So if it was not copied at that moment there is nothing to recover — the key has to be revoked and a new one issued.
You decide the scope
Each key is granted an explicit list of permissions and can do nothing outside them. A key with no scopes can do nothing at all.
The permissions chosen have to actually exist: an unknown one is refused at creation rather than silently doing nothing later.
A site-bound key works only there
Bind a key to a site and a request arriving with it on a different site is refused. A key bound to no site works everywhere.
On a single-site install this makes no difference; on a multisite one it is a real boundary.
Revoking is immediate and final
A revoked key stops working at once and cannot be reactivated. Its row stays so the history is not lost.
Expiry can be automatic
A key can be given an expiry date, or Settings can define a default lifetime applied to new keys. An expired key is refused exactly like a revoked one.
"Last used" is for housekeeping
The last-used column shows which keys are genuinely in service. One untouched for months is usually one that should be revoked.