Unfortunately you need a global admin API key for this. I’m hoping the team will implement a way to make granular checks for upload rights, badge creation and editing, badge assignment, and badge removal.
You don’t need a global admin API key for this anymore — when creating an API key, you can specify different specific things related to creating, granting, or destroying badges. Don’t forget “upload” if you want to do what this example shows and add your own images. That’s in a separate section from the badges API permissions.