Read-Only Provisioning Key

It would be nice if we could also have a read-only provisoning key to interact with the REST api.

This would allow us to use the RO key for things like reporting without giving away all permissions