Purpose

A person mints an API key for the workspace they are in, chooses what it may do (read, write, delete, or the ai gateway), sees the raw key exactly once, and can revoke any key later. The invariant that makes it trustworthy is that the raw key exists in one place for one moment: it is returned by the create response only, held in component state until dismissed, rendered into one DOM node, never written to storage, and every later read shows the prefix; and that a key cannot be minted without a scope, because an unscoped key is unlimited on the backend.

It makes B10 visible (the self-service scope set, the workspace-scoped list, the mint that also enqueues the sync to Prima, the revoke) and B9 (the key the CLI login minted appears in the same list, named after the machine, and this page is the only place to revoke it).

When to use

Trigger phrases: "create an API key", "where do I get a key for the gateway", "the key is only shown once", "revoke the key", "which scopes", "the key from alchemy login", "no scope selected", "the developer page". Surface: the Labs SPA, because minting needs a Labs session with a workspace context (the X-Workspace-ID header the intercepted client adds) and the page lives in the shell's Settings domain.

Not for the developer portal's /schluessel, which mints ai-only keys from a prima_dev session with its own page (identity-auth/ui/developer-portal-keys-page), for the admin's mint on behalf of a user (identity-auth/ui/admin-users-console), or for the chat server's per-session key, which no person sees (identity-auth/ui/chat-signin-and-workspace-picker). The second screen on this row, /developer, is the older English dashboard: it mints without a scope picker, shows a dollar cost that D2 retires (the one AI ledger is Prima's), and carries a documentation tab for routes that do not exist; a new app ships /settings/api-keys and not /developer (Gotchas).

Stack assumptions

S1 tokens (ink, ink-60, ink-40, line, brand-purple, danger, paper), S2 (the provider tree and the intercepted api client) and S3; the shell from ui-design-system/ui/appshell-navigation. Pinned per S2 at fd8558f (2026-09-12): react 19.2.0, react-router-dom ^7.8.2, tailwindcss 3.4.18, axios ^1. Component library: @prima-modules/alchemy-ui 0.1.0 pinned to fd8558f (Badge, Button, Card, Checkbox, Heading, Input, Text).

Data-fetch style: ApiKeysCard uses api (services/api.ts: Bearer plus X-Workspace-ID on every call, the 401 refresh-retry), which is right because the routes need the workspace header (developer_router.py 85 to 92). DeveloperDashboard uses raw fetch with a hand-built header set (getHeaders, 42 to 50) and swallows every error (catch (error) {} at 62, 76, 110, 129), which is why it is not the reference. Copy: de-CH du-Form on the settings page (with "Du" capitalised in the lead, ApiKeysSettings.tsx 21 to 23); English on /developer.

Data model

Client state (ApiKeysCard.tsx 67 to 77): keys: ApiKey[], loading, error, the form's name and scopes (default ['read'], 72), creating, freshKey: ApiKey | null ("deliberately NOT persisted anywhere", 75), copied. ApiKey (44 to 55) is the backend's APIKeyResponse (developer_router.py 51 to 61): id, key?, key_prefix, name, description?, created_at, expires_at?, last_used_at?, is_active, scopes?. SCOPES (37 to 42) mirrors _SELF_SERVICE_SCOPES (35) by hand: read, write, delete, ai, each with a de-CH title and a hint naming the HTTP methods it covers. The demo's Props add page, the shell's user and workspace, and for /developer the usage tile values and the modal phase.

Browser storage: none written by this row. Read: currentWorkspaceId (the request interceptor adds it as X-Workspace-ID; DeveloperDashboard.tsx 46 to 47 reads it directly) and the S2 tokens. The raw key is never in localStorage, sessionStorage, a cookie or a URL; it is in freshKey.key in React state and in the clipboard when the person copies it (navigator.clipboard.writeText, 133). Dismissing the panel (setFreshKey(null), 159) is the end of it.

What is not stored client-side: the key hash, the security fields (suspended_until, anomaly_score, B10), the sync state to Prima. What the list does not carry: scopes (Gotchas), so the badges per row are empty at fd8558f.

API surface

All three routes are on developer_router (app_fastapi.py 827, mounted on ALL_SURFACES), take CurrentUser, and resolve the workspace from the middleware's request.state.workspace_id (middleware/workspace_middleware.py 393 to 402), which the X-Workspace-ID header sets. The envelope is S7's; the card reads e.response.data.detail, which the envelope never carries (Gotchas), so the fallback strings below are what a person sees at fd8558f.

The raw key's shape (B9): prima_pk_ plus 43 URL-safe characters, 52 in all; key_prefix is the first twelve plus ..., 15 characters. No postMessage or WebSocket contract.

Application logic

1. /settings/api-keys mounts inside the shell (Settings is the active domain: /settings is one of its paths, nav.tsx 263; no column item is active, since none points here). The card calls GET /keys (load, 79 to 94); loading renders "Wird geladen …".
2. The list arrives, newest first. Each row: name, "widerrufen" when inactive, the scope badges (empty at fd8558f), the prefix, the two dates in de-CH (fmt, 57 to 64). Active rows carry "Widerrufen".
3. Create. The person types a name and ticks scopes; read is pre-ticked. Unticking the last scope shows the warning and disables the button (211 to 219). Submit posts {name, scopes} (creating renders "Wird erstellt …"); on success freshKey is set, the form resets, the list reloads.
4. The fresh-key panel renders above the form: the sentence that it will not be shown again, the key in one <code> node, "Kopieren" (which flips to "Kopiert" for two seconds, 130 to 139), the scope badges from the create response. "Fertig" drops the key from state; nothing else references it.
5. Revoke. window.confirm echoes the key's name and warns that integrations lose access at once (117 to 120); DELETE then a reload; the row keeps its place with "widerrufen" and no button.
6. A failure on any of the three calls renders the error card above everything (143 to 147) with the card's fallback string; the person retries.
7. /developer is the older screen: tiles from /usage, the list with a copy button that copies the prefix (a prefix is not a key), a create modal without scopes (so every key it mints is ["read"] and fails on the gateway with the ai-scope 403, B10 Gotchas), and a docs tab whose examples point at unmounted routes.

Invariants

• The raw key is rendered into one node, from component state, exactly once per mint; no storage key, no URL, no log line on the client holds it (grep -n "freshKey" ApiKeysCard.tsx shows state, the panel and the copy handler only).
• No mutation without an endpoint: mint is POST /keys, revoke is DELETE /keys/{id}; the list is never edited locally, it is reloaded after each.
• The form cannot submit an empty scope set (canSubmit in helpers.ts; the backend would default it to read, which is safe, but the rule keeps the intent visible: unscoped means unlimited in api/dependencies.py, B10).
• The scope set on the screen equals _SELF_SERVICE_SCOPES; a scope the backend refuses is a 400 rendered as its sentence, never a silent drop (mintOutcome in helpers.ts mirrors 94 to 126).
• Every call carries the workspace header; a key is listed, minted and revoked in the workspace the shell shows and no other (the 404 on a cross-workspace revoke is the backend's, since 2026-08-04).
• A revoked key stays listed as "widerrufen" and cannot be revoked twice; there is no un-revoke.
• Errors render the envelope's error string when it is a sentence for the person (the scope list, the workspace header) and a de-CH fallback otherwise (apiErrorMessage).

Frontend

The rendering is the live rebuild api-keys-settings-and-developer-dashboard/demo.tsx, built from @prima-modules/alchemy-ui and @prima-modules/tokens, rendered by the docs host as one frame per state, every state inside the appshell-navigation rebuild at viewport: 1440 (the settings page is shell-wrapped and its cards are laid out for the desktop column). ApiKeysCard is the Labs card lifted into a presentational component over { keys, loading, error, name, scopes, creating, freshKey, copied }; helpers.ts holds the pure decisions (SCOPES, toggleScope, canSubmit, prefixDisplay, apiErrorMessage, fmtDate, fmtDateTimeEn, mintOutcome) and helpers.test.ts pins them.

States: default (/settings/api-keys with four keys: a website integration with read and write, the CLI's AlchemyCLI on <hostname> key with its description, an ai-only key never used, and a revoked one), loading (the list card reads "Wird geladen …"), empty (a fresh workspace: "Noch keine Schlüssel in diesem Workspace."), fresh-key (the one-time panel above the form with the sample key prima_pk_example plus zeros to 52 characters, "Kopiert" and the read badge; the same key is first in the list below with its prefix), no-scope (name typed, every box unticked, the warning, the button disabled), creating (the mint button disabled and relabelled "Wird erstellt …", the name and the checkboxes still live, as the card has it at 185 to 221: no spinner, no loading prop), error (the envelope's "Unsupported scope(s): admin. ..." string in the error card, which is what a build to this recipe shows and fd8558f does not), developer-dashboard (/developer with the four usage tiles, the English list with "Created:" and, on the three rows that have one, "Last used:" in the source's en-US clock format, the two tabs with their icons; the modal closed).

Component tree of the source, which the rebuild keeps (ApiKeysCard.tsx 141 to 263): Shell (appshell-navigation, activePath /settings/api-keys or /developer, hasTour false) around SettingsPage (the page's py-6 px-4 sm:px-6 lg:px-6 gutter, max-w-4xl, Heading level 1, Text muted, ApiKeysCard) or DeveloperPage (max-w-7xl p-6); inside the card, Card (glass, padding="lg") x3 or x4, Text for titles and rows, Badge at the atom's defaults (variant default, size md: bg-stone-200 text-zinc-700) for every scope and for "widerrufen" (169, 240 to 242), Button at the atom's default size md (h-12 px-8) in primary to mint and to copy and secondary to revoke and to dismiss (159, 167, 219, 253), code for the raw key and the prefix. Where the rebuild differs, it is listed below: the name field is Input inputSize="sm" and each scope is Checkbox size="sm" with label and description, where the card writes a bare input with its own classes. Tokens: paper ground (the shell's), ink, ink-60, ink-40, line (the divide-y), ink/5 behind the key, danger for errors (on a span of its own, see below), brand-purple through the atoms; the dashboard's tiles use Card variant="default" padding="md", its tabs and "Create New Key" are Button at the default size with Key, BookOpen and Plus icons (18, 18, 20), its per-row copy and delete are Button variant="ghost" size="sm", and the plan tile sets text-brand-purple (Gotchas: at fd8558f the atom's text-ink wins; the rebuild puts the class on a span). Responsive: the settings column is max-w-4xl; the dashboard's tiles are grid-cols-1 md:grid-cols-4; below sm the shell hides its sidebar and the page is content only.

What the rebuild changes on purpose, each with its reason: the name input and the checkboxes are the atoms where the card writes its own classes (26 to 32, 185 to 209); the two #A32218 literals become danger, set on a span inside Text because a colour passed through the atom's className loses to its own text-zinc-800 (Gotchas); the plan tile's text-brand-purple likewise moves to a span inside Heading; the scopes are listed in the backend's sorted order (ai, delete, read, write) rather than the card's (read, write, delete, ai) so the badges and the picker agree; one ellipsis after the prefix (prefixDisplay); the card's dates from the ISO date part with no clock or zone (fmtDate; the card's toLocaleDateString depends on both) and the dashboard's from the ISO string's own clock in the source's en-US shape (fmtDateTimeEn, "Aug 14, 2026, 09:12 AM"); copy, because the house rule keeps em dashes out of shipped files: the lead (ApiKeysSettings.tsx 21) and the four scope hints (ApiKeysCard.tsx 38 to 40) carry a colon where the source has a dash ("zugreifen: Website-Formulare", "GET: Daten abrufen"), and a never-used key reads "Zuletzt genutzt nie" where fmt (58) renders a dash; the pages' min-h-screen (ApiKeysSettings.tsx 16) is left off because the stage sets the height (appshell-navigation Gotchas), the rest of each page's gutter is kept; the window.confirm is not reproduced (a browser dialog); the dashboard's modal is absolute inside the frame instead of fixed and its Textarea is left out; the APIDocs tab is not rendered. Everything else, the button and badge variants included, is the source's. The sample list carries scopes per row, which the list route does not return at fd8558f (Gotchas): the demo shows the screen the card was written for.

Security & tenancy

What the browser may hold: never a key. The raw key is component state for the seconds between the create response and "Fertig", plus the clipboard if the person copies it; the prefix (prima_pk_ plus three characters) is the only durable thing on screen and is not a credential (lookup is by hash, never by prefix, B10). The S2 tokens and currentWorkspaceId are the only storage read.

Origin and CSRF: the three calls ride the intercepted client with the Bearer and the workspace header; in token mode nothing is sent automatically. Surface gating from /me.surfaces: the page is inside PrivateRoute and the shell; the route itself is on ALL_SURFACES, which is how the developer portal mints from a prima_dev session, and that session is limited to ai by the backend (118 to 126), not by anything on this screen. Hidden by CSS versus enforced: the disabled button on an empty scope set is a courtesy; the backend defaults an empty list to read and refuses unknown scopes and wildcards (test_self_service_keys_are_never_unscoped, test_gateway_scopes_are_not_mintable, S5 Tests). Cross-workspace: the list and the revoke are filtered by the header's workspace on the server (the 2026-08-04 fix), so a person with two workspaces sees and revokes only the current one's keys.

Attacker-controlled inputs: the key name and description (rendered as text through React; max_length=255 on the server, 40); the list entries (server data, rendered as text); the clipboard is written, never read.

Tests

• Colocated: api-keys-settings-and-developer-dashboard/helpers.test.ts (vitest, 10 cases: the sorted scope set, toggle and submit rules, one ellipsis whatever the prefix ends with, the envelope-first error reader, the zone-free de-CH date, the dashboard's en-US date with its 12-hour clock, the mint outcomes incl. the 400 sentence and the Prima-surface 403). Run npx vitest run --config modules/identity-auth/ui/api-keys-settings-and-developer-dashboard/vitest.config.mjs: 10 passed (2026-09-12). The root vitest.config.mjs (1350915) does not include modules/; see auth-screens Tests.
• Render check: node tooling/verify/render-smoke.mjs identity-auth/ui/api-keys-settings-and-developer-dashboard renders the eight states with renderToString; 0 failures on 2026-09-12.
• Labs at fd8558f: no test imports ApiKeysCard or DeveloperDashboard (grep -rln "ApiKeysCard\|DeveloperDashboard" src/**/__tests__ e2e prints nothing). Backend coverage of the routes is B10's (tests/test_surface_scoped_access.py::test_self_service_keys_are_never_unscoped, tests/test_admin_api_key_scopes.py). What a new app adds: a jsdom test of the card with a mocked api asserting (a) the fresh key appears in exactly one node and is gone after "Fertig", (b) the button is disabled with no scope and with a blank name, (c) a 400 body renders its error string, (d) a revoke reloads the list; and a Playwright walk: mint with read and ai, copy, dismiss, observe the prefix in the list, revoke, observe "widerrufen".
• node --test: not needed; the helpers are covered by the vitest file.

Deploy & ops

Ships in the Labs bundle (S2 Deploy & ops); no env of its own. Backend side: developer_router mounted on ALL_SURFACES (app_fastapi.py 827), the workspace middleware ahead of it, and the outbox to Prima (prima_key_sync, B10) with its drain scheduled, or every mint 500s by design. The clipboard API needs a secure context (https: or localhost); on plain http "Kopieren" silently does nothing and the key stays readable on screen (the card's comment at 137). Rollback is the bundle's; no migration of its own. Argus: GET /api/developer/keys with the seeded owner's token and workspace header answers 200 with an array.

Gotchas

• 2026-09-12 (measured at fd8558f): /settings/api-keys has no inbound link. nav.tsx's Settings column (263 to 271) lists "Developer / API" pointing at /developer, and grep -rn "settings/api-keys" src prints only the route in App.tsx (281). The screen that closes the wiki's 2026-08-20 question is reachable by URL alone, while the column sends people to the older dashboard that mints read-only keys. Fix: point the item at /settings/api-keys (and retire /developer).
• 2026-09-12 (measured at fd8558f): GET /api/developer/keys omits scopes (the mapping at developer_router.py 240 to 251 sets every field but that one), so the card's per-row badges (241 to 243) never render and a person cannot tell an ai key from a read key in the list. Fix: scopes=(key.permissions or {}).get("scopes") in the list mapping.
• 2026-09-12 (measured at fd8558f): the card reads e?.response?.data?.detail on all three calls (86, 111, 126); the Labs envelope carries error, never detail (app_fastapi.py 768 to 786), so the backend's sentences ("Unsupported scope(s) ...", "Workspace context required ...", "API key not found") never reach the screen and every failure shows the generic fallback. Fix: apiErrorMessage (envelope first).
• 2026-09-12 (measured at fd8558f, rendering trap): key_prefix is stored with a trailing ... (developer_router.py 131) and the card appends … (246), so every row reads prima_pk_abc....... Fix: prefixDisplay.
• 2026-09-12 (measured at fd8558f): DeveloperDashboard.tsx posts {name, description, expires_in_days} with no scopes (89 to 97), so every key minted from /developer is ["read"] and fails on the gateway with the ai-scope 403 (B10 Gotchas), and its "Copy" button copies the prefix (183 to 189), which authenticates nothing. Its formatDate is en-US; its deleteApiKey confirm is English; every catch is empty. A new app does not ship it.
• 2026-09-12 (measured at fd8558f): APIDocs.tsx (736 lines, last changed 2026-06-10 apart from the D1a sweep) documents POST /api/v1/execute, /api/v1/analyze, /api/v1/stream and /api/v1/predict against a retired product host as API_BASE_URL (58); none of the four is mounted (grep -rn 'prefix="/api/v1' backend/api backend/app_fastapi.py prints nothing; the strings survive only in middleware/usage_tracking.py 34 to 36 and services/rate_limit_service.py 272 to 273 as allow-list entries). The gateway a key with ai reaches is /api/prima/v1 (D3: the standalone Prima service is the reference; the in-Labs copy is legacy). The demo does not render the tab.
• 2026-09-12 (measured at fd8558f): the usage tiles show cost_this_month in dollars from an example rate (developer_router.py 353 to 354, $0.01 per 1000 tokens) and tokens_remaining from users.token_quota; D2 (2026-09-11) makes Prima's prepaid ledger the one truth for AI spend, so these tiles are pre-D2 and are not copied.
• 2026-09-12 (measured at fd8558f): the mint answers 200, not 201 (@router.post("/keys", response_model=APIKeyResponse) at 70 declares no status code); _shared/auth-dependency-pattern's API table says 201 for the same route. The code wins; the card does not care.
• 2026-09-12 (measured at fd8558f): ApiKeysCard.tsx keeps two #A32218 literals (145, 212) that the D1a sweep in the same commit left in place; the token is danger. Rendering trap in the swap: the Text atom sets text-zinc-800 on its element (atoms/Text.tsx 39) and has no tone prop, so text-danger passed through className loses to it in the built CSS (the literal only wins because Tailwind emits arbitrary values after theme colours); measured on the docs host 2026-09-12 as the alert rendering in zinc-800. Fix in Labs: a tone (or color) prop on Text; until then the token goes on a span inside Text, which is what the demo does.
• 2026-09-12 (measured at fd8558f, rendering trap): DeveloperDashboard.tsx 195 sets text-brand-purple on Heading for the plan tile, and the atom's own text-ink (atoms/Heading.tsx 16) wins in the built CSS, so the plan renders in ink at fd8558f. Fix: the same tone prop on Heading, or the class on an inner span (the demo).
• 2026-09-12 (measured at fd8558f, rendering trap): the card's dates go through toLocaleDateString('de-CH') (57 to 64), so a verifier run in another zone or locale differs by a day or a format; the demo's dates come from the ISO date part.
• 2026-09-12 (measured at fd8558f): the AlchemyCLI on <hostname> key (B9) is listed here with no hint that it is the CLI's; "Auto-created by AlchemyCLI login" sits in description, which the card does not render (the dashboard does). Fix: render description under the name.

Reference implementation

Branch: alchemy_labs d1a-token-source at fd8558f (2026-09-12), forked from feat/service-desk b1089b6; the card landed in 9562e28 on the same line. Paths relative to frontend/:

• src/components/settings/ApiKeysCard.tsx (264 lines): the header comment (5 to 24), class strings (26 to 32), SCOPES (37 to 42), ApiKey (44 to 55), fmt (57 to 64), state (67 to 77), load (79 to 94), toggleScope (96 to 97), create (99 to 115), revoke (117 to 128), copy (130 to 139), the error card (143 to 147), the fresh-key panel (149 to 173), the create card (175 to 223), the list (225 to 261).
• src/pages/settings/ApiKeysSettings.tsx (31): the page (13 to 30). src/App.tsx: the route (281 to 287), /developer (993 to 999).
• src/components/nav.tsx: the Settings domain (258 to 272; paths 263, "Developer / API" 270).
• src/components/DeveloperDashboard.tsx (455): getHeaders (42 to 50), the fetches (52 to 78), createApiKey (80 to 115), deleteApiKey (117 to 131), formatDate (139 to 147), the page (149 onward).
• src/components/APIDocs.tsx (736): API_BASE_URL (58), displayKey (60 to 63), the endpoint table (80 onward).

Backend anchors: backend/api/routers/developer_router.py (_SELF_SERVICE_SCOPES 35 to 36, models 38 to 61, create_api_key 70 to 211 with the scope rules 94 to 126 and the outbox 153 to 173, list_api_keys 213 to 256, revoke_api_key 258 to 331, get_usage_stats 333 to 368), backend/middleware/workspace_middleware.py (get_workspace_id 393 to 402), backend/app_fastapi.py (827), backend/services/primaapi/identity.py (GATEWAY_KEY_PREFIX 59).

Deviations of the reference from this recipe, dated 2026-09-12: the eleven Gotchas above; the card's own class strings instead of the atoms; the scope order; the double ellipsis; the locale date.

Acceptance checks

From alchemy_labs/frontend at fd8558f, or a new app built to this recipe:

1. grep -rn "settings/api-keys" src | wc -l prints 1 at fd8558f (the route) and at least 2 on a build to this recipe (the route and the column item).
2. sed -n 240,251p ../backend/api/routers/developer_router.py | grep -c scopes prints 0 at fd8558f; on a build to this recipe GET /api/developer/keys returns scopes on every row (check 4c observes it).
3. grep -c "#A32218" src/components/settings/ApiKeysCard.tsx prints 2 at fd8558f and 0 on a build to this recipe.
4. Browser walk-through, signed in as the seeded owner, tour closed: (a) open /settings/api-keys, observe the heading, the create card with read pre-ticked, and the list card with "Noch keine Schlüssel in diesem Workspace." on the scratch database; (b) untick read, observe the warning and the disabled button; type a name, tick read and ai, submit, observe the fresh-key panel with a key starting prima_pk_, 52 characters, and the two badges; count the nodes containing the key: document.body.innerText.split(key).length - 1 is 1; (c) click "Fertig", observe the panel gone and the key nowhere on the page, the list showing the name, the prefix (prima_pk_ plus three characters and one ellipsis on a build to this recipe, two at fd8558f), "Erstellt" today; on a build to this recipe the read and ai badges; (d) with the key, curl -H "X-API-Key: $KEY" $API/api/prima/v1/models is 200 and curl -X POST -H "X-API-Key: $KEY" $API/api/forms/templates is 403 (the prefix lock, S5); (e) click "Widerrufen", confirm, observe "widerrufen" on the row and the curl from (d) answering 401 "API key is deactivated"; (f) in devtools set localStorage.currentWorkspaceId to another workspace of the same user and reload, observe a list that does not contain the key; (g) open /developer, observe the English page and, on a build to this recipe, a redirect to /settings/api-keys instead.
5. Demo gate: npm run check prints no line for this recipe; node tooling/verify/render-smoke.mjs identity-auth/ui/api-keys-settings-and-developer-dashboard prints ok for the eight states and 0 failures; npx vitest run --config modules/identity-auth/ui/api-keys-settings-and-developer-dashboard/vitest.config.mjs prints 10 passed, matching the Tests section's count.
6. Docs host: build the index site as in auth-screens check 5 and open /docs/modules/identity-auth/ui/api-keys-settings-and-developer-dashboard/: eight frames at 1440 scaled to the column, the fresh-key frame's code[data-testid="fresh-key"] present once, [role=alert] in the error and no-scope frames with computed colour --color-danger, zero console and page errors (measured 2026-09-12 at prima.li 86fe9d1; at that host commit every viewport: 1440 stage keeps its 24px padding and overflows by 48px horizontally, a rule-order defect in the host's demo-frame.css, not this recipe's, and the same on the appshell-navigation page).
7. Verifier: node tooling/verify/compare.mjs identity-auth/ui/api-keys-settings-and-developer-dashboard --state empty --docs http://127.0.0.1:4321 --app http://127.0.0.1:3020 --session-file tooling/verify/.labs-local/session.json (the seeded owner has no key, so empty is the matching state) writes a report with page_errors: []; the reader judges main and accepts a mismatch_ratio under 0.2, excluding by name the checkbox and input chrome (atoms versus the card's own classes), the scope order, and the colon in the lead; button and badge chrome is not excluded, since the rebuild renders both at the atoms' defaults as the card does.