Treat API keys like passwords. Raw keys are shown ONCE on creation; only the 8-character prefix is stored client-side after that.