A real credential for external integrations, completely separate from a user login. Only the key's prefix is ever shown again after creation -- the full key cannot be retrieved.