Small update to this.
Do not delete the RW API credential set from the AMP console. If you do, it will delete any event streams created using that credential set.
Also, input in the app will continue to use RW credentials even after you change configuration to different RO credential. You'll need to edit local/inputs and update the api_id and api_key for your created input manually if you want to be sure those keys aren't stored anywhere.
... View more