Maybe X-Hasura-Access-Key should be renamed to X-Hasura-Secret-Key to make it more obvious. Like all oauth providers (google, github etc) tend to call their private keys secret_key and their public key public_id.

Also, maybe the permissions tab should be disabled when access key is not set to make it more obvious.