Read-Only Keys
Creating read-only keys is rather simple. Just create your key as normal and set GET as the only allowable methods.
Since Jira's and Confluence's Cloud REST API dilligently uses HTTP verbs, no GET request can manipulate data on your instance.