Daytona API keys

• Provider documentation daytonaio/daytona v0.190.0 (01c502b): generateApiKeyValue() = dtn_ + crypto.randomBytes(32).toString('hex'); the same inline form since 5271af9 (2025-04-28); re-checked 2026-09-28 (no newer provider source) · observed 2026-09-29 · dtn_ + exactly 64 lowercase hex (32 random bytes), 68 in all; no separator or checksum; T1 as of v0.190.0 (2026-06-23) under R9
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11

Arrival evidence (#464, product redact-secret#970; #860 handoff daytona.md, READY by ruling R9). T1 as of v0.190.0 (2026-06-23): the provider generator returns dtn_ + 32 random bytes hex-encoded, and the same inline form has existed since 2025-04-28 (R1). Core development moved to a private codebase in June 2026, so nothing public shows the live cloud still issues the shape; R9 extends R3's date rule to provider code, so the contract stands as of that date until a newer provider source contradicts it. Every later public source (the daytona/clients OpenAPI and CLI, helm-charts scripts, SDK 0.218.0, the docs dump) is prefix-only and none contradicts it. Without the prefix the body is SHA-256 shaped, so the prefix is load-bearing. The same generator mints region proxy, SSH-gateway and runner keys, which are lexically identical. Excluded: dtn_secret_ Secrets-feature placeholders, dtn_artifact_ stdout markers, unprefixed self-provisioned runner keys (openssl rand -hex 32), legacy self-hosted base64-UUID keys, caller-supplied values, DAYTONA_JWT_TOKEN (jwt keeps it) and dtn_*** or short OpenAPI placeholders. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1037).