When you want to use the plugins directory api to get your keys you have to go to this bespoke page:

https://moodle.org/plugins/api.php?sesskey=xxxxxx  

1) But this page has a sesskey in it which is wrong, urls should never have a sesskey in the visible url. eg you cannot deep link directly to this page

2) It's not clear why this page exists, when core has a page for managing tokens:

/user/managetoken.php

Is there a reason why we can't just use this page and turn on this capability?