Copy your token now

This is the one moment the full secret exists on screen. We store only a hash of it — we can't show it again and we can't recover it. If you lose it, revoke this token and create a new one. This is the most important screen in the flow.

Contract. The raw secret is the token field returned only on the 201 from POST /api/organizations/{orgId}/tokens (backend/security/src/routes/api-tokens.ts reveals it once and stores a hash). No list or get endpoint ever returns it again.

Interaction rules this frame freezes. (1) Copy affordance — data-action="copy-secret" writes the full secret to the clipboard and confirms via data-copy-status. (2) Explicit acknowledgement — Done stays disabled (data-requires-ack) until the user ticks data-ack-checkbox, so no one dismisses the only copy by reflex. (3) Honest, unrecoverable warning — the copy shown is an obviously-fake placeholder; a real implementation never logs or re-renders the secret. Navigating away discards it from the DOM.