I was thinking of an API key that was scoped both to a specific customer and a specific service provider (perhaps both have to do something to provision it).

Billing goes to the customer, debug logs etc go to the service provider.