It doesn't, but the point stands that users should be able to create their own auth keys and use them to authenticate a third party application to the target service, rather than having the app author bake some arbitrary key into the code.