How can I configure JIRA REST API access for least privilege?

[John Maddalozzo]

I am evaluating a server install version of JIRA and FishEye. I want to be able to do a pre-commit check via REST to make sure that the commit message contains a reference to an open JIRA Issue key. I can do that with a named user, storing the password in a script, but I'm looking for a more secure solution. 

Does JIRA support API keys for server installs?

or

Can I configure a user in JIRA that will only be able to use the REST API to get Issue status?

or

Can I configure a REST API user that cannot login to the application?

or

Can anyone suggest a better approach?

Thanks!

John