An attacker can steal your API credentials while your application carries on working. Canaries can make some of that hidden activity visible.