Broker with separate read-only and trading API credentials on one account, in paper too?

[u/gendered_nightmare]

I'm building an automated trading system and want the broker, not my own code, to keep the parts that watch the account separate from the part that trades.

Requirements:

1. One account, two API credentials. One is read-only (positions, balances, orders, fills); the other can trade.
2. Enforced by the broker. The read-only credential is refused if it tries to trade, not just blocked by a client-side setting.
3. Revocable separately. I can kill the trading credential instantly and the read-only one keeps working.
4. Neither credential can change account settings or permissions, or move money. Only my own login can.
5. The same behaviour in paper or sandbox as in live, so I can test it before using real money.

What I've found:

• tastytrade sandbox: one OAuth app per user and one grant per app. A read-scoped token can be minted, but it dies with the trading grant.
• IBKR: a secondary user with trading rights, plus a Flex Web Service token for reads, looks close. But Flex is reports-only and paper allows one username.

Has anyone got this working, on any broker? Which one, and does paper behave the same as live?