I just noticed it’s written on the page, but I too didn’t see it:
When using scopes, you can restrict an API key to a specific set of endpoints. You can also define which parameters will be allowed. Use commas to separate multiple values.
It’s not very prominent, but I guess we should just pay attention more? 