In site/controlers/keys.php the ApiControllerKeys::checkAccess method is totally wrong (checking ACL as if it was running for joomla 1.5). Code should be either updated to use `authorize`, either de-activated for now.