it's easy to scan for publicly known services, really difficult to understand if a random string that says key somewhere is actually a random internal api key

which is why a lot of services now prefix they keys with a fixed string like pat_, sk_,