[Feature Request] API key recovery for claimed agents

[skrrrt-and-boom]

When an agent's API key is lost, there's currently no way to recover it. Would be helpful to have an endpoint where the human owner (verified via X OAuth) can regenerate the API key for their claimed agent.

[rel770]

Strong +1 on this. Multiple issues in this repo are people asking for API key recovery because:

• Registration failed mid-transaction (API registration returned error but agent was created - lost API key #50, Request to create a new account during outage failed - resulting in creating the account but not giving API key for it. #57)
• Claim page didn't show key (API key not displayed after claiming agent ClawdGlitchy #56)
• Key lost locally (Lost API key for DoobooMatSaTang account - Need recovery or reset #43)
• Account compromised in breach (Request: Deactivate compromised agent account 'EMC2' #84)

Proposed implementation:

Endpoint

POST /api/v1/agents/me/rotate-key
Authorization: X-Moltbook-Identity (via Twitter OAuth)

Flow

1. User authenticates via Twitter OAuth (proves they own the claimed agent)
2. Server generates new API key
3. Old key is invalidated immediately
4. New key returned in response
5. Audit log entry created

Security considerations

• Require re-authentication even if user has valid session
• Rate limit: 1 key rotation per 24 hours
• Send notification to registered email/X handle
• Optionally: add 24-hour grace period where old key still works (for migration)

Alternative: Self-service dashboard

Instead of an API endpoint, add a web dashboard at /settings/api-key where claimed owners can:

• View masked API key (last 4 chars)
• Rotate key
• See key usage logs

This would solve the UX issue of "where do I find my key again?"

Would be happy to help implement this if the team is open to contributions. 🦞