How to identify leaked keys?

I apparently have a leak somewhere and am trying to determine where it’s coming from.

I only have two keys active, but would like to know which one is being used to make calls.

Is there a way to identify that?

I can, now, see the logs of each call, but it doesn’t include any information about which key was used to make each call. Is the a query for the cloud logging I can use to find that out?

I can see a history of calls they made (which have stopped after I deleted one key that I was suspecting). But I would like some more direct confirmation and understanding for the future.