I agree, the secret should be deleted after "pairing" then the client keypair become the "API key"