API keys

Issuing and revoking orchestrator-global API keys

client.APIKeys mints and revokes API keys. All three methods require the master token, the server enforces this regardless of what token the client was constructed with.

API keys are Postgres-only. An orchestrator started without DATABASE_URL does not register the /v1/api-keys routes at all, so Create, List, and Revoke come back as a 404 *APIError with code route_not_found, not unauthorized. That is what you will hit against the in-memory stub described in Advanced usage.

key, err := client.APIKeys.Create(ctx, "ci-runner")
if err != nil {
	log.Fatal(err)
}
fmt.Println("save this now:", key.Key) // shown exactly once

label is optional. key.Key holds the raw secret and is returned exactly once, it cannot be recovered afterward, store it immediately.

Everything else

Method	Purpose
`List(ctx)`	List key metadata, `APIKey` has no `Key` field. `LastUsedAt`/`RevokedAt` are `nil` until they happen.
`Revoke(ctx, id)`	Revoke the key with the given `id` (the `APIKey.ID`, not the secret itself).

These mirror the HTTP API one to one.