add a little security detail

Author: jescalan

docs/guides/development/machine-auth/api-keys.mdx

@@ -43,6 +43,9 @@ If you would like to prevent the API Keys tab from appearing in the user or orga
 
 It's also possible to render the [`<APIKeys />` component](/docs/reference/components/api-keys) directly if you'd like to embed the API key management UI directly into your application's user interface.
 
+> [!TIP]
+> Hiding the UI doesn't prevent users from creating API keys — they can still call Clerk's Frontend API directly. If you want to ensure only backend-issued API keys are valid, use the `scopes` or `claims` parameters (available only via the [Backend SDK](#creating-api-keys)) when creating keys. Your verification logic can then reject any keys missing the required scopes or claims, making user-created keys ineffective.
+
 ## Using API keys in requests
 
 Once you have an API key, you can use it to authenticate requests to your application's API. The API key should be sent as a Bearer token in the `Authorization` header: