Creating API key and secret for clients -- is it still the suggested approach?

There are no immediate plans, at this point, I’m afraid, to implement API keys.
You can add this feature request at Auth0: Secure access for everyone. But not just anyone., explaining your use case and why it would work better in your scenario than the client-credentials flow. This feedback goes directly to Product, so it’s the best way to voice these types of needs.

Thanks in advance!