API keys

Create, list, and revoke keys without storing the secret.

A new key is shown once. The database stores a prefix for identification and a SHA-256 hash of the secret. The plaintext secret is not written to the database or to audit metadata.

Last used stays empty because the API gateway is not accepting model traffic yet. Revoking a key sets a timestamp and keeps the row visible.

cxp_live_…   shown once
prefix        stored
sha256        stored