API keys

Keys belong to one organization. An org may hold many pairs. A key cannot read or mutate another org.

Credential	Prefix	Shown
API key	`zyneo_key_test_` / `zyneo_key_live_`	Always
Secret	`zyneo_sk_test_` / `zyneo_sk_live_`	Once

Create another pair

curl https://org.zyneo.app/v1/keys \
  --header "X-Zyneo-Key: zyneo_key_test_…" \
  --header "Authorization: Bearer zyneo_sk_test_…" \
  --header "Content-Type: application/json" \
  --data '{"name":"ci","environment":"test"}'

List with GET /v1/keys. Revoke withPOST /v1/keys/:id/revoke. The secret is hashed at rest (SHA-256). Only a display prefix is stored for the API key identity.