If you have external team members, like contractors, you're able to create one-off Doppler API keys which grant access to only a single environment.
