token name — A recognizable name for the key
description — What this key is used for
bot name — Display name for the bot user that represents this key
expired — When the key should stop working (optional)
team — Bind the key to a specific team
permission/scope — Which operations the key can perform (see Permission Scopes below)
Raw API keys are never stored in the database. Only a SHA-256 hash is persisted.
The raw key is shown only once at creation time. If lost, you must create a new key.
Company API keys are bound to their company and team. They cannot access data from other companies.
Expired keys are rejected immediately with 401 Unauthorized.