One credential serves every caller
A single upstream key is shared by staging, production, a script someone left running and the contractor who joined last month. When it leaks, there is nothing to revoke that isolates one caller without breaking all of them.