Revoke the account API keys and OAuth access and refresh tokens, then show a new full-access key once in the HTML page. The POST needs the csrf nonce from the GET page. A POST without that nonce does not mint a key. The key is not emailed and is not stored. A second POST does not show the key. An expired link does not mint a key.