Do I need separate API keys per client?

Separate keys are optional. For client isolation, create a key such as “Client A — Claude” and select only Client A’s workspace. Requests for another workspace are rejected. Keys, billing and usage limits remain at the account level.