allowed_cidrsarray[string] or nullA bare IP or CIDR per entry; omitted/empty means unrestricted (default).
Example: ["203.0.113.0/24"]
expires_atstring<date-time>namestringA label for this key, shown back on list/create.
Example: "CI pipeline"
scopesarray[string] or nullMust be non-empty; every entry must be a known scope.
Example: ["sessions:read","sessions:write"]