The API Key actions are under the cluster:admin/xpack/security namespace.
The only cluster privileges that allow access to those actions are manage_security and all, both of which grant far more access than is actually required to create an API Key.

There should be a specific privilege to allow a user to create/delete their own API keys.