Be VERY CAREFUL doing this - both you and the user should understand that this API key represents credentials to BE that user and should be kept secure.
We do have a method for having the user create API keys and restricting scope on those… but I do not believe that is exposed in the UI.