API keys

A key authenticates the hosted MCP endpoint and the run and publish routes. It carries scopes — read for the hub's read tools, run for jobs that spend credits, publish for your own artifacts — and a key with only the scopes it needs is the difference between a leaked token that reads and one that spends.

Shown once

The response to a creation request is the only time the full key is readable: what is kept is the prefix, which identifies it in this list, and an Argon2id hash of the rest. Lose it and the fix is a new key and a revocation, not a recovery. Revocation takes effect on the next call.