Currently there is no documentation describing the limitations for any custom keys that can be created by API.

Examples: app_id, app_key, user_key.

In the admin portal UI there is a note when creating a custom key that states the following:

Only alphanumeric characters [0-9, a-z, A-Z], hyphen-minus ,
between 5 and 256 characters long. No spaces allowed.

This accounts for the app_key & client_secret but when creating a new key or even a new application plus keys on the 3scale API there needs to be clearer documentation stating what is/isn't allowed.

Important: This also needs to be added to the ActiveDocs.