[agentHits]

Summary

• better-auth keeps only a hash of each API key, so a key not copied at creation could never be recovered. New keys now also get an encrypted copy (encryptedText, AES-256-GCM) in a new apikey_secret table (migration 0206), kept outside better-auth's apikey table.
• New user.revealApiKey mutation returns the key to its owner. It requires a browser session and an open super session (even for users without a super password, like Traefik TLS files), is classified dangerous, checks the key's owner and organization, and writes a reveal entry to the audit log.
• Settings → API/CLI Keys gets an eye button per key. Without an open super session the existing unlock dialog asks for the super password, then the key is shown with a copy button. Keys created before this change have no stored copy, so their button is disabled with an explanation.
• user.get exposes a revealable flag per key; the new-key dialog text now mentions that the key can be revealed again.

Test plan

• __test__/users/api-key-reveal.test.ts: reveal works inside a super session and is audited; denied without a super session, for API-key sessions, for other users' keys, for keys of another organization; old keys return a clear NOT_FOUND
• super-session-procedure-access test lists user.revealApiKey as dangerous
• tsc --noEmit for apps/dokploy and packages/server, biome check on changed files
• Full vitest run: only Docker-dependent *.real.test.ts and the load-flaky Telegram alert test failed; the latter passes on its own
• Manual check on dev after rollout: create a key, reveal it with the super password, confirm the audit entry

🤖 Generated with Claude Code