# API-keys settings page — candidate milestone

A settings sub-page for managing bex API keys via bex-api's GraphQL: `apiKeys` query + `createApiKey` (secret returned exactly once — surface the copy-once UX) / `revokeApiKey` mutations (`docs/ADR006-bex-api.md`). Keys are Hydra clients stamped `bex.co/api-key`; list hides and revoke refuses platform clients (e.g. `bex-bootstrap`), so the UI must handle a filtered set gracefully.

Render parity: model on Render's account/API-keys settings IA (create → show-once secret → list → revoke). Lives alongside the existing Kratos-backed `settings.tsx` (account settings) but is a **distinct** surface (API credentials, not identity).

Milestone-sized (list + create-with-show-once + revoke + states) → **promote when scoped**. Deferred behind the services/logs arc (m4–m6).

Source: `/pm-brainstorm for w5` (2026-07-06) + "consistent with render.com". Goal: dashboard pillar, pillar-1 API-first.

> **Retired 2026-07-08, superseded** — duplicate of open milestone `w4/m8` (API keys in the dashboard, settings surface), which owns this work; one owner per DO_NOT_DO no-duplication rule.
