A Limited Access key is enough. It is stored only in this browser's localStorage and is sent only to api.torn.com when you press Refresh.