feat(#567): admin UI for channel API keys

docs/CHANGELOG.md

@@ -18,6 +18,26 @@ entry. See `CONTRIBUTING.md` § Releases & changelog.
 
 ## [Unreleased]
 
+### Added — admin UI for the public API keys (#567)
+
+- **Admin UI** (`web-ui/app/admin/api-keys/`): create/list/revoke against
+  `/api/public/v1/admin/keys`, which shipped in #438/#439 with no page at all —
+  keys could only be minted with `curl`. Each row shows the key's
+  `ApiKeyRecord.id` verbatim with a one-click copy, which is the point of the
+  issue: a public MCP key-binding (#550) is keyed on that id, so an operator
+  previously had to read it out of the API by hand.
+- A created key's plaintext token is shown exactly once, right after creation,
+  and creation is blocked while that one-time reveal is still on screen — the
+  create button and every form field stay disabled until the operator
+  explicitly dismisses it, so a second key can never silently overwrite the
+  first one's only-ever-shown token before it is copied. Revoking is a
+  two-step confirm-then-revoke per row with independent busy/confirm state per
+  key, and the list reload is guarded against out-of-order responses so a
+  slower in-flight fetch cannot stomp a newer one's result. Known backend
+  codes (`not_found`, `operator_auth.unavailable`,
+  `auth.missing`/`auth.invalid`, `invalid_request`) map to translated messages
+  rather than surfacing the raw response body.
+
 ### Added — errors on the LLM-access and credential screens now explain themselves (#604)
 
 - The providers panel used to render the middleware's English rejection

web-ui/app/_lib/api.ts

@@ -112,7 +112,7 @@
   const { pathname } = window.location;
   if (pathname === '/login' || pathname === '/setup') return;
   const returnPath = pathname + window.location.search;
   window.location.assign(`/login?return=${encodeURIComponent(returnPath)}`);
 }
 
 async function getJson<T>(path: string, init?: RequestInit): Promise<T> {
@@ -4648,3 +4648,58 @@
 ): Promise<{ deliveries: ConductorWebhookOutboundDelivery[] }> {
   return getJson(`${WEBHOOKS_BASE}/subscriptions/${encodeURIComponent(id)}/deliveries`);
 }
+
+// -----------------------------------------------------------------------------
+// Public API keys (issues #438/#439; admin UI follow-through #567) —
+// /api/public/v1/admin/keys.
+//
+// This router lives in @omadia/channel-api, not under /v1/operator/* like the
+// rest of this file's admin surfaces — it is mounted at API_PREFIX
+// `/api/public/v1`, gated by the same operator-session cookie via its own
+// `operatorAuth` middleware (see adminKeysRouter.ts). getJson/postJson still
+// apply here unchanged: same cookie, same 401-bounces-to-/login behavior.
+// -----------------------------------------------------------------------------
+
+const API_KEYS_BASE = '/public/v1/admin/keys';
+
+export interface ApiKeyPublicView {
+  id: string;
+  label?: string;
+  rateLimitPerMinute: number;
+  scopes: string[];
+  /** Epoch ms. */
+  createdAt: number;
+  /** Epoch ms. Present iff the key has been revoked. */
+  revokedAt?: number;
+}
+
+export interface CreateApiKeyInput {
+  label?: string;
+  rateLimitPerMinute?: number;
+  /**
+   * Omit this field entirely to accept the backend's legacy default
+   * (`['chat:write']`). An explicitly empty array is REJECTED by the
+   * backend with 400 — it reads `[]` as a deliberate "grant nothing"
+   * request, never as "use the default". Callers must never pass `[]`.
+   */
+  scopes?: string[];
+}
+
+export interface CreateApiKeyResult {
+  key: ApiKeyPublicView;
+  /** Plaintext — present only in this one response. Never returned again by
+   *  any other endpoint; do not persist it beyond the reveal-once UI. */
+  token: string;
+}
+
+export async function listApiKeys(): Promise<{ keys: ApiKeyPublicView[] }> {
+  return getJson(API_KEYS_BASE);
+}
+
+export async function createApiKey(input: CreateApiKeyInput): Promise<CreateApiKeyResult> {
+  return postJson(API_KEYS_BASE, input);
+}
+
+export async function revokeApiKey(id: string): Promise<{ key: ApiKeyPublicView }> {
+  return postJson(`${API_KEYS_BASE}/${encodeURIComponent(id)}/revoke`, {});
+}