---
id: w4/m3/t002
title: "API-key verbs in Core + REST /v1/api-keys + GraphQL + MCP parity"
worker: worker4
status: done
estimate: 45m
depends_on: [w4/m3/t001]
---

## Objective

APIKey/APIKeyStore seam (apikeys.go) with Hydra admin impl (create/list/delete OAuth2 clients, 404 maps to ErrNotFound); Core verbs Create/List/RevokeAPIKey; REST POST/GET/DELETE /v1/api-keys (secret once, 400 on blank name); GraphQL apiKeys/createApiKey/revokeApiKey; MCP create_api_key/list_api_keys/revoke_api_key.

## Files

- operator/internal/api/apikeys.go
- rest.go
- graphql.go
- mcp.go
- core.go
