API keys /api/keys

📝 TODO — this English page is a skeleton. The structure mirrors the Chinese page, which is fully written.

Method	Path	Description
GET	/api/keys	List keys (masked, plus plaintext when viewable)
POST	/api/keys	Create a key; body { "name": "..." }
DELETE	/api/keys/:id	Revoke a key

• Up to 10 active keys per account; beyond that the create call returns 400 too_many_keys.
• Keys are stored as a SHA-256 hash plus an AES-256-GCM encrypted copy, so the console can display them again. They cannot be found by searching the database for the plaintext.
• Revocation takes effect immediately; requests with a revoked key return 401.

See also

• Authentication
• Gateway