While you are here, I have been asking for years to have better access control on API keys so they can only use assigned servers. So my staging cant send prod emails...

API tokens are server specific aren't they?

They are!

I understand this change might be a large undertaking to implement across the entire API, and although it would be good to do everywhere, it’s primarily just the send email API that needs it.

I like the idea. Staff engineer and I discussed a bit. Added something to our backlog so we don't lose track of it.