What powers do tmate API keys have?

[kobus-v-schoor]

Hi there, I'm trying to determine what access an attacker to get if they were to come into possession of my tmate API key. Could they see active named sessions? Could they do something else? From what I can tell the API key can only be used to create more named sessions, is that correct?

PS thanks for this awesome project!