This would help in identifying which keys are in use.
The algorithm could be:
a) on each incoming request with authenticated API key, check if its LastUsed is older than 5 minutes or so, if it is update the timestamp in DB.
b) on each incoming request with authenticated API key bump in-RAM LastUsed metric which will get periodically written to DB by a scheduled task.
Bad thing about a) is that each HTTP request can potentially trigger a DB write.
Bad thing about b) is that it assumes long-running process (= not Lambda or similar)