If the key is public, bots will lean about it.

And how to rotate that key? Seems like extremely complex for no additional benefits compared to a blacklist.