Lists the reseller's named API keys. The secret is shown only once, at creation; this returns a masked hint instead. Also returns available_scopes. Requires the admin role, and is never reachable with an API key — a key must not be able to mint another key.