Yeah, that's the main one I had in mind. API key lets you select what characters to include, which features are visible for that API key, etc. I want to say I wrote code that interacted with these back in 2012 or so and this wasn't new.
Meanwhile GitHub just got scoped API keys in 2022. Cloudflare got scoped API keys maybe last year or two years ago? Like to me this has felt like a baseline of API token design for a long time.