value is only ever present in the create response (confirmed live — apiKeys.list never includes it), so the model and call sites treat it as a one-time reveal, not persisted state. expiresAt omitted (not null) for a non-expiring key, matches synthesized Encodable's default encodeIfPresent behavior.