Create

POST /api/v1/me/api-keys

Body: {"name": "my-agent"}

The plaintext api_key is returned only once.

List

GET /api/v1/me/api-keys

Returns is_active / revoked_at etc.

Revoke

POST /api/v1/me/api-keys/{key_id}/revoke

Disable

Admins can disable an individual key or the user's API access; disabled credentials return 401.