Self-serve key issuance: a developer who already holds one key can mint another for their OWN account -- no operator step. scopes is the only field the request body carries.

The new key's customer AND its tier are both taken from the AUTHENTICATED caller's own key, never from the request, so a key can never be issued for another tenant nor carry more entitlement than the key that authorized it. Sending a tier is rejected with a 422 rather than ignored. To change your tier, change your plan -- the new tier then applies to every key on the account.

The mint also inherits the parent key's acquisition surface, exactly as rotation carries it forward: an additional self-serve mint is the same acquisition, and the same entitlement, as the key that authorized it.

scopes, omitted, inherits the presenting key's own scopes; sent explicitly, it must be a subset of them -- a scoped-down key can never mint itself a wider replacement. 403 names the excess when it isn't.

Requires the account scope.