Deleting a public API key needs MANAGE_ACCESS_RULES, like creating one

Any member of an org could delete the org's public chat / integration keys: deleteKey checked only that the key belonged to the caller's org.

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.