That’s exactly how I did. There is a link for generating a key with only the necessary read-only permissions.