[mid-kid]

This sounds like a great way to cause Denial-of-Service attacks.

[Thiez]

Denial of service by blocking API keys is really your happy case when someone malevolent has your API keys.

[dirigeant]

If someone steals API keys and invalidate them by sending HTTP requests instead of using them, you can only thank them.

[mrmanner]

You need to actually send them the API key, so not really.

[afiori]

To do that you need to guess or steal the API keys.