API keys currently only offer a single "view passwords" permission, which also grants access to OTPs. There's no way to grant access to one without the other.
Request
Split this into two separate permissions on API keys:
View passwords – grants access to stored passwords only
View OTPs – grants access to OTP codes only
This lets admins scope API keys more tightly, for example, issuing a key that can pull passwords for an integration without also exposing OTPS.