API keys

Cleartext secrets are shown once at create / rotate time. The server stores only a SHA-256 hash.