Denial of service by blocking API keys is really your happy case when someone malevolent has your API keys.

If someone steals API keys and invalidate them by sending HTTP requests instead of using them, you can only thank them.

You need to actually send them the API key, so not really.

To do that you need to guess or steal the API keys.