Flow: Create (draft) → Register (live on POST /v1/retrieve immediately, no deploy) → Publish (authored on Kara) → rollout in the Kara dashboard (human action — the badge here flips when done). Grant consumer keys on the API Access page. Secrets are referenced by env-var name only; a genuinely new credential still needs an env addition + container recreate.