Four methods. API detail: Authentication.
Only create and rotate ever answer a secret. Store it then; list never returns one.
create
POST /v1/api_keys. The reply is the key plus secret, org_id, and mode (test | live) — the only response shape that carries them. A key can only mint another key in its own mode.
list
GET /v1/api_keys — name, prefix, scopes, created_by; never a secret.
rotate
POST /v1/api_keys/{id}/rotate. Mints a replacement secret under the same id; the reply carries it once.
revoke
DELETE /v1/api_keys/{id}. Immediate — the next request on the old secret is a 401. 
