The `restrictIndices` of API keys should be typed as: - an array of strings OR - a comma-separated string Both format should be handled at serialization/deserialization time.