Makes sense — handing full API keys to agents is a huge risk surface. Even with fake UUIDs at MVP stage, the scoped/expiring pattern seems useful. Curious if you’ve thought about integrating with existing secrets managers (Vault, Doppler, etc.) instead of rolling custom crypto later on.