API keys can already be restricted to only specific operations for specific datastores.
For example, say you have a datastore named “player_datastore” and you want to allow only Get and Set entries but not Delete to this particular datastore. This can be done already now.
Our tutorials explain how to do this.