Fine-grained permissions for API keys – any best practices, great examples, etc?

Can you offer, or point to, any advice on providing fine-grained permissions for API keys? Any great example implementations you've seen? Any docs or best practices I should look at?

(I'm not interested in the technical implementation - I'm more interested in the UI, the documentation, etc)

By "fine grained permissions for API keys", I mean that a user could create an API key with a certain set of permissions (eg CREATE resource type X, READ (but not modify) resource type Y, prohibit access to endpoints A and B, etc), then create another key with other permissions, etc. Admins would need to see what keys were created by whom, what permissions those keys have, usage on a per-key basis, do key regeneration, etc.