Hello, I'm kinda new to this, I'm reviewing a PR and saw this: Is this legit, or should I revoke this ? I can't find in documentation what the API key can do.

Yes we do not recommend storing api keys in plain text. You can rotate the api key by navigating your org settings page. There is a section there to rotate the key