That's... not the worst idea, actually. We already have an API key implementation for the new API, and while there are some security concerns if a full DB dump was to be leaked, you're right in that they're not going to have been used elsewhere, and the scope of what actions you can take are limited to what the API allows (and thus doesn't include things like changing the pw or email on an account, or shop actions), and can be easily revoked. Shoving it into the old API auth flow is a little hacky, but better than nuking old clients that are hardcoded to challenge/response only.