Revokes a key. The key stops working immediately; the record is retained with revoked_at set for audit. Only revoke a key once it is no longer in use. Returns the updated key. Returns 409 if the key is already revoked, and 422 if it is the app's only key (an app must keep at least one). The public app key clients use to connect. The key secret, used for server-side request signing. Returned only when the key is created, and never shown again — store it securely. If lost, create a new key and revoke this one. When the key was revoked, or null if still active.