Mint a pre-authorized link key for the signed-in account

What an owner may choose about a key: a label, a fan-out, a lifetime.

All three are optional, and the deployment's defaults (OD-10: one use, ninety days, unnamed) are what an empty body asks for — the common case is a single machine and should not require an owner to have an opinion. The upper bounds are not here: they are settings, so a static le= would be a second copy of a number an owner can ratify, and the two would drift. The policy layer refuses above the cap with the same 400 this model would have given.

The one and only time a key's plaintext leaves this deployment.

Nothing stores it, so this body is unrepeatable: a client that loses it revokes the key and mints another. The metadata beside it is what GET will keep answering, so a console can render the new row without a refetch.