[Bug] OpenCode Zen dashboard only shows truncated API keys (sk-XXXX...YYYY) - full key never reaches user, API returns 401 Invalid API key #44948

Environment

• OpenCode Zen account: freshly created 2026-08-25 via GitHub OAuth
• Workspace created, multiple API keys created via dashboard (UI + programmatically)
• Endpoint tested: https://opencode.ai/zen/v1 and https://opencode.ai/zen/go/v1 (chat/completions and responses)

Expected

After creating an API key, the full secret (sk- + 64 chars, per console key.ts: Key.create) should be shown once and/or copyable via the Copy button, so it can be used against /zen/v1 and /zen/go/v1.

Actual

1. The dashboard (https://opencode.ai/workspace//keys) only ever displays/returns truncated keys:
   • key: "sk-hSm...oGil" (6-char prefix)
   • keyDisplay: "sk-hSmj...oGil" (7-char prefix)
2. The Copy button copies the truncated value (verified via navigator.clipboard.readText(): "sk-hSm...oGil").
3. Every truncated variant (6-char, 7-char, with dots, without) returns 401 JSON: {"type":"AuthError","message":"Invalid API key."} on /zen/v1/chat/completions, /zen/go/v1/chat/completions and /responses endpoints.
4. Key.create server action returns only the keyID (e.g. key_01M...), never the plaintext secret. Key.list returns the key column but it is already truncated server-side in the observed production build.

Evidence

• SSR serialized cache (observed in page source): key.list contains key:"sk-hSm...oGil" and keyDisplay:"sk-hSmj...oGil" - no full 67-char value anywhere on the wire.
• curl Authorization: Bearer sk-hSm...oGil / sk-hSmj...oGil / sk-b6P8...ZRKK etc. => all Invalid API key.
• Because the full secret is never exposed (not even momentarily in create response, which returns only the ID), it is impossible to authenticate. This blocks every API user including external tools (e.g. Hermes) pointed at https://opencode.ai/zen/go/v1.

Suggestion

Return the plaintext key at least once from Key.create (or show a one-time reveal modal client-side after creation) and have the Copy button write the full key. Truncated display is fine for listing, but the copy/API value must be the full secret.