OAuth-inspired delegated AI access stop sharing raw API keys