Reducing friction is a good idea but I would argue that asking folks to generate and send you a secret is likely the same amount as them getting an API key that you generate for them. You’ll also run into uncertainties in secret key formats that are used by disparate clients.

If you really want to: One alternative would be to generate a random JWT while the developers are on the website and ask them to secure a given JWT by adding their email, doing on boarding that way.

Addendum: In terms of reducing friction, if this is going to be a paid API, I would suggest adding a free tier that allows N requests before you either rate limit or cut off, and send an email to ask for a conversion