---
id: w4/m3/t005
title: "E2E: bootstrap client mints key, key calls API, revoke kills it"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m3/t004]
---

## Objective

scripts/auth-e2e.sh reworked: seed bootstrap, its token authenticates REST+GraphQL while garbage/missing get 401, POST /v1/api-keys mints a key whose own token authenticates, list omits the secret, DELETE revokes and the key can no longer mint tokens. PASS on the CAPD mock cluster.

## Files

- scripts/auth-e2e.sh
