You can just say API K*y, it's okay.

You're not the only person, but it's definitely not the way to keep your shit safe online.

Best practice is to use a different sufficiently strong (e.g. long and random) password for every account. That way, when an account's password is leaked, it doesn't immediately compromise every other account for which you've reused that password.

I generally advise people to use a password manager (I like Bitwarden) to store their myriad passwords, so they only have to remember a single master password.

ofc these bots aren't necessarily sneaking into their operators' password managers and stealing their passwords; the operators willingly and knowingly given the bots access to these things, so they can offload the drudgery of e.g. looking at a calendar to them