diff --git a/README.md b/README.md
index faa8ce4..efacbbc 100644
--- a/README.md
+++ b/README.md
@@ -142,6 +142,522 @@ To make the experience between your app and the `api_keys` dashboard more seamle
 
 You can check out the dashboard on the [live demo website](https://apikeys.rameerez.com).
 
+### Customizing the Dashboard
+
+The gem provides two levels of customization for the mounted dashboard:
+
+#### Level 1: Use the stock dashboard (default)
+Works out of the box with good defaults. No configuration needed.
+
+#### Level 2: Override CSS variables
+Tweak colors and spacing by overriding CSS variables in your application's stylesheet:
+
+```css
+:root {
+  --api-keys-primary-color: #your-brand-color;
+  --api-keys-danger-color: #dc3545;
+  --api-keys-success-color: #28a745;
+  --api-keys-badge-secret-bg: #e7f1ff;
+  --api-keys-badge-publishable-bg: #fef3cd;
+  /* See layout file for all available variables */
+}
+```
+
+#### Building Custom Integrations
+
+If you need complete control over the UI (e.g., to match your design system with Tailwind, Bootstrap, etc.), you can build your own views and controllers while using the gem's model layer and helpers.
+
+The gem provides a comprehensive set of helpers specifically designed for custom integrations. These patterns are battle-tested from real production integrations.
+
+##### What You'll Need
+
+A complete custom integration typically requires:
+
+| Component | Purpose |
+|-----------|---------|
+| Initializer | Configure the gem + opt into form helpers |
+| Routes | RESTful resources (~6 lines) |
+| Controller | Handle CRUD operations (~90 lines) |
+| Views | index, new, edit, success pages |
+| Helper include | One line in ApplicationHelper |
+
+##### Quick Setup
+
+**1. Initializer** (`config/initializers/api_keys.rb`):
+
+```ruby
+# Include form builder extensions for cleaner forms
+Rails.application.config.to_prepare do
+  ActionView::Helpers::FormBuilder.include(ApiKeys::FormBuilderExtensions)
+end
+
+ApiKeys.configure do |config|
+  config.current_owner_method = :current_organization
+  config.authenticate_owner_method = :authenticate_organization!
+  # ... other config
+end
+```
+
+**2. Routes** (`config/routes.rb`):
+
+```ruby
+namespace :settings do
+  resources :api_keys, only: [:index, :new, :create, :edit, :update] do
+    post :revoke, on: :member
+    get :success, on: :collection
+    post :create_publishable, on: :collection  # If using key types
+  end
+end
+```
+
+**3. Helper** (`app/helpers/application_helper.rb`):
+
+```ruby
+module ApplicationHelper
+  include ApiKeys::ViewHelpers
+end
+```
+
+**4. Controller** - See the complete example below.
+
+---
+
+### Complete Controller Example
+
+Here's a production-ready controller (~90 lines) that handles all API key operations:
+
+```ruby
+# app/controllers/settings/api_keys_controller.rb
+module Settings
+  class ApiKeysController < ApplicationController
+    before_action :set_api_key, only: [:edit, :update, :revoke]
+    before_action :set_available_scopes, only: [:new, :create, :edit, :update]
+
+    def index
+      @publishable_key = current_organization.api_keys.publishable.active.first
+      @secret_keys = current_organization.api_keys.secret.active.order(created_at: :desc)
+      @inactive_keys = current_organization.api_keys.secret.inactive.order(created_at: :desc)
+    end
+
+    def new
+      @api_key = current_organization.api_keys.build(key_type: :secret)
+    end
+
+    def create
+      @api_key = current_organization.create_api_key!(
+        name: api_key_params[:name],
+        key_type: :secret,
+        scopes: api_key_params[:scopes],
+        expires_at_preset: params.dig(:api_key, :expires_at_preset)
+      )
+
+      ApiKeys::TokenSession.store(session, @api_key)
+      redirect_to success_settings_api_keys_path
+    rescue ActiveRecord::RecordInvalid => e
+      @api_key = e.record
+      flash.now[:alert] = "Failed to create API key."
+      render :new, status: :unprocessable_entity
+    end
+
+    def success
+      @token = ApiKeys::TokenSession.retrieve_once(session)
+      redirect_to settings_api_keys_path, alert: "Token can only be shown once." and return if @token.blank?
+    end
+
+    def edit
+    end
+
+    def update
+      if @api_key.update(api_key_params)
+        redirect_to settings_api_keys_path, notice: "API key updated."
+      else
+        flash.now[:alert] = "Failed to update API key."
+        render :edit, status: :unprocessable_entity
+      end
+    end
+
+    def create_publishable
+      unless current_organization.can_create_api_key?(key_type: :publishable)
+        redirect_to settings_api_keys_path, alert: "You already have a publishable key."
+        return
+      end
+
+      current_organization.create_api_key!(name: "SDK Key", key_type: :publishable)
+      redirect_to settings_api_keys_path, notice: "Publishable key created!"
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to settings_api_keys_path, alert: "Failed to create key."
+    end
+
+    def revoke
+      if @api_key.revocable?
+        @api_key.revoke!
+        redirect_to settings_api_keys_path, notice: "API key revoked."
+      else
+        redirect_to settings_api_keys_path, alert: "This key cannot be revoked."
+      end
+    end
+
+    private
+
+    def set_api_key
+      @api_key = current_organization.api_keys.find(params[:id])
+    end
+
+    def set_available_scopes
+      @available_scopes = current_organization.available_api_key_scopes
+    end
+
+    def api_key_params
+      params.require(:api_key).permit(:name, scopes: [])
+    end
+  end
+end
+```
+
+---
+
+### Model Scopes
+
+Filter keys by type and status:
+
+```ruby
+# By key type (when using key_types feature)
+@org.api_keys.publishable          # Only publishable keys
+@org.api_keys.secret               # Secret keys (and legacy keys without type)
+
+# By status
+@org.api_keys.active               # Not revoked and not expired
+@org.api_keys.inactive             # Revoked or expired
+@org.api_keys.expired              # Past expiration date
+@org.api_keys.revoked              # Manually revoked
+
+# Chain them
+@org.api_keys.publishable.active
+@org.api_keys.secret.inactive.order(created_at: :desc)
+```
+
+---
+
+### Owner Instance Methods
+
+Methods available on any model with `has_api_keys`:
+
+```ruby
+# Get available scopes for forms
+@available_scopes = current_org.available_api_key_scopes
+# Returns owner-specific scopes, or falls back to global config
+
+# Check if owner can create a key (respects limits)
+current_org.can_create_api_key?(key_type: :publishable)
+# => false if limit reached
+
+# Create a key with all options
+@api_key = current_org.create_api_key!(
+  name: "My Key",
+  key_type: :secret,                    # or :publishable
+  scopes: ["read", "write"],            # Blank values auto-removed
+  expires_at: 30.days.from_now,         # Explicit date
+  expires_at_preset: "30_days",         # OR use preset (takes precedence)
+  environment: :live,                   # Defaults to current_environment
+  metadata: { team: "backend" }         # Optional JSON metadata
+)
+```
+
+---
+
+### API Key Instance Methods
+
+Methods available on `ApiKeys::ApiKey` instances:
+
+```ruby
+# Token (only available immediately after creation)
+@api_key.token                    # => "sk_live_abc123..." (plaintext, once only)
+
+# Display
+@api_key.masked_token             # => "sk_live_••••abc1" (safe for UI)
+@api_key.viewable_token           # => full token if public key type, nil otherwise
+
+# Status checks
+@api_key.active?                  # => true if not revoked and not expired
+@api_key.expired?                 # => true if past expires_at
+@api_key.revoked?                 # => true if manually revoked
+@api_key.revocable?               # => false for non-revocable key types
+
+# Type checks (when using key_types)
+@api_key.public_key_type?         # => true if token can be viewed again
+@api_key.key_type                 # => "publishable", "secret", or nil
+@api_key.environment              # => "test", "live", or nil
+
+# Actions
+@api_key.revoke!                  # Revoke the key (raises if not revocable)
+
+# Scopes
+@api_key.scopes                   # => ["read", "write"]
+@api_key.allows_scope?("read")    # => true
+
+# Metadata
+@api_key.name                     # => "Production Server"
+@api_key.created_at
+@api_key.expires_at
+@api_key.last_used_at
+@api_key.requests_count           # If tracking enabled
+```
+
+---
+
+### Token Session Helper
+
+Manages the "show token once" pattern for secret keys:
+
+```ruby
+# Store token after creation
+ApiKeys::TokenSession.store(session, @api_key)
+
+# Retrieve and clear (returns nil on subsequent calls)
+@token = ApiKeys::TokenSession.retrieve_once(session)
+
+# With custom session key (if managing multiple token types)
+ApiKeys::TokenSession.store(session, @api_key, key: :my_custom_key)
+@token = ApiKeys::TokenSession.retrieve_once(session, key: :my_custom_key)
+```
+
+---
+
+### Expiration Options Helper
+
+For building expiration dropdowns:
+
+```ruby
+# Get options for select
+ApiKeys::ExpirationOptions.for_select
+# => [["No Expiration", "no_expiration"], ["7 days", "7_days"], ["30 days", "30_days"], ...]
+
+# Get default value
+ApiKeys::ExpirationOptions.default_value
+# => "no_expiration"
+
+# Parse a preset to a date
+ApiKeys::ExpirationOptions.parse("30_days")
+# => 30.days.from_now
+
+ApiKeys::ExpirationOptions.parse("no_expiration")
+# => nil
+
+# Exclude "no expiration" option
+ApiKeys::ExpirationOptions.for_select(include_no_expiration: false)
+```
+
+---
+
+### Form Builder Extensions (Opt-in)
+
+Add to your initializer to enable:
+
+```ruby
+Rails.application.config.to_prepare do
+  ActionView::Helpers::FormBuilder.include(ApiKeys::FormBuilderExtensions)
+end
+```
+
+#### `api_key_expiration_select`
+
+Renders a select dropdown with all expiration presets:
+
+```erb
+<%# Basic usage %>
+<%= form.api_key_expiration_select %>
+
+<%# With CSS classes (Tailwind example) %>
+<%= form.api_key_expiration_select(class: "w-full px-4 py-3 border rounded-lg") %>
+
+<%# With custom default selection %>
+<%= form.api_key_expiration_select(selected: "30_days") %>
+```
+
+#### `api_key_scopes_checkboxes`
+
+Renders scope checkboxes with a block for custom markup:
+
+```erb
+<%# With block - you control the HTML, gem handles the logic %>
+<%= form.api_key_scopes_checkboxes(@available_scopes) do |scope, checked| %>
+  <label class="flex items-center gap-2">
+    <%= check_box_tag "api_key[scopes][]", scope, checked, class: "rounded" %>
+    <code><%= scope %></code>
+  </label>
+<% end %>
+
+<%# For new records, all scopes are checked by default %>
+<%# For existing records, only the key's current scopes are checked %>
+
+<%# Override checked state %>
+<%= form.api_key_scopes_checkboxes(@scopes, checked: :none) do |scope, checked| %>
+  ...
+<% end %>
+
+<%# checked options: :all, :none, or an array of specific scopes %>
+```
+
+#### `api_key_token_data`
+
+Returns structured data for building token display UIs:
+
+```erb
+<% data = form.api_key_token_data %>
+<code><%= data[:masked] %></code>
+
+<% if data[:viewable] %>
+  <button data-token="<%= data[:full] %>">Copy</button>
+<% end %>
+
+<%# Returns: { masked:, full:, viewable:, type:, environment: } %>
+```
+
+---
+
+### View Helpers
+
+Include in your ApplicationHelper:
+
+```ruby
+module ApplicationHelper
+  include ApiKeys::ViewHelpers
+end
+```
+
+#### Status Helpers
+
+```erb
+<%# Get status as symbol %>
+<%= api_key_status(@key) %>
+<%# => :active, :expired, or :revoked %>
+
+<%# Get human-readable label %>
+<%= api_key_status_label(@key) %>
+<%# => "Active", "Expired", or "Revoked" %>
+
+<%# Get full status info for styling %>
+<% info = api_key_status_info(@key) %>
+<span class="<%= info[:color] == :green ? 'bg-green-100' : 'bg-red-100' %>">
+  <%= info[:label] %>
+</span>
+<%# Returns: { status: :active, label: "Active", color: :green } %>
+<%# Colors: :green (active), :red (revoked), :gray (expired) %>
+```
+
+#### Type & Environment Helpers
+
+```erb
+<%# Key type label %>
+<%= api_key_type_label(@key) %>
+<%# => "Publishable", "Secret", or nil %>
+
+<%# Environment label %>
+<%= api_key_environment_label(@key) %>
+<%# => "Test", "Live", or "Default" %>
+
+<%# Type checks %>
+<%= api_key_publishable?(@key) %>  <%# => true/false %>
+<%= api_key_secret?(@key) %>       <%# => true/false %>
+
+<%# Get environment from a token string (useful on success page) %>
+<%= api_key_environment_from_token(@token) %>
+<%# => :test, :live, or nil %>
+
+<%= api_key_environment_label_from_token(@token) %>
+<%# => "Test mode", "Live mode", or "Default" %>
+```
+
+---
+
+### View Examples
+
+#### Index Page (Key List)
+
+```erb
+<%# Publishable key section %>
+<% if @publishable_key %>
+  <code><%= @publishable_key.viewable_token || @publishable_key.masked_token %></code>
+  <span><%= api_key_environment_label(@publishable_key) %> mode</span>
+<% else %>
+  <%= button_to create_publishable_settings_api_keys_path, method: :post do %>
+    Create Publishable Key
+  <% end %>
+<% end %>
+
+<%# Secret keys table %>
+<% @secret_keys.each do |key| %>
+  <tr>
+    <td><%= key.name || "Unnamed key" %></td>
+    <td><code><%= key.masked_token %></code></td>
+    <td><%= api_key_status_label(key) %></td>
+    <td>
+      <%= link_to "Edit", edit_settings_api_key_path(key) %>
+      <%= button_to "Revoke", revoke_settings_api_key_path(key), method: :post %>
+    </td>
+  </tr>
+<% end %>
+```
+
+#### New/Edit Form
+
+```erb
+<%= form_with(model: @api_key, url: settings_api_keys_path) do |form| %>
+  <%# Name %>
+  <%= form.text_field :name, placeholder: "e.g., Production Server" %>
+
+  <%# Expiration (new keys only) %>
+  <%= form.api_key_expiration_select(class: "form-select") %>
+
+  <%# Scopes %>
+  <%= form.api_key_scopes_checkboxes(@available_scopes) do |scope, checked| %>
+    <label>
+      <%= check_box_tag "api_key[scopes][]", scope, checked %>
+      <%= scope %>
+    </label>
+  <% end %>
+
+  <%= form.submit %>
+<% end %>
+```
+
+#### Success Page (Show Token Once)
+
+```erb
+<% if @token.present? %>
+  <input type="text" value="<%= @token %>" readonly>
+  <button data-copy="<%= @token %>">Copy</button>
+  <span><%= api_key_environment_label_from_token(@token) %></span>
+
+  <p>This key will only be shown once. Copy it now!</p>
+<% else %>
+  <p>Token already shown. Create a new key if needed.</p>
+  <%= link_to "Create New Key", new_settings_api_key_path %>
+<% end %>
+```
+
+---
+
+### Best Practices
+
+Based on real production integrations:
+
+1. **Use RESTful routes** - `resources :api_keys` with member/collection actions, not custom route definitions.
+
+2. **Separate form-only params** - Access `expires_at_preset` via `params.dig(:api_key, :expires_at_preset)` rather than including it in strong params (it's not a model attribute).
+
+3. **Use `before_action` for shared setup** - Extract `@available_scopes` to a before_action rather than setting it in multiple actions.
+
+4. **Let validations handle errors** - Rescue `ActiveRecord::RecordInvalid` and re-render the form rather than pre-checking everything.
+
+5. **Use the gem's helpers consistently** - Use `api_key_status_label(key)` everywhere rather than hardcoding "Active" in some places.
+
+6. **Check limits before showing UI** - Use `can_create_api_key?(key_type:)` to conditionally show/hide create buttons.
+
+7. **Keep controllers thin** - The gem handles token generation, hashing, scope filtering, and validation. Your controller just orchestrates.
+
+See the "How it works" section below for additional model methods.
+
 
 ## How it works
 
diff --git a/app/controllers/api_keys/keys_controller.rb b/app/controllers/api_keys/keys_controller.rb
index 781856d..66787ec 100644
--- a/app/controllers/api_keys/keys_controller.rb
+++ b/app/controllers/api_keys/keys_controller.rb
@@ -4,6 +4,7 @@ module ApiKeys
   # Controller for managing API keys belonging to the current owner.
   class KeysController < ApplicationController
     before_action :set_api_key, only: [:show, :edit, :update, :revoke]
+    helper_method :key_types_feature_enabled?
 
     # GET /keys
     def index
@@ -20,6 +21,14 @@ def index
       @api_keys = base_scope.active.order(created_at: :desc)
       # Optionally, fetch inactive ones for a separate section or filter
       @inactive_api_keys = base_scope.inactive.order(created_at: :desc)
+
+      # When key_types feature is enabled, separate publishable and secret keys
+      if key_types_feature_enabled?
+        @publishable_keys = @api_keys.select(&:public_key_type?)
+        @secret_keys = @api_keys.reject(&:public_key_type?)
+        @inactive_publishable_keys = @inactive_api_keys.select(&:public_key_type?)
+        @inactive_secret_keys = @inactive_api_keys.reject(&:public_key_type?)
+      end
     end
 
     # GET /keys/:id
diff --git a/app/controllers/api_keys/security_controller.rb b/app/controllers/api_keys/security_controller.rb
index e1c38f7..9601fa2 100644
--- a/app/controllers/api_keys/security_controller.rb
+++ b/app/controllers/api_keys/security_controller.rb
@@ -6,11 +6,19 @@ class SecurityController < ApplicationController
     # Skip the user authentication requirement for these static pages
     # as they contain general information.
     skip_before_action :authenticate_api_keys_owner!, only: [:best_practices]
+    helper_method :key_types_feature_enabled?
 
     # GET /security/best-practices
     def best_practices
       # Renders app/views/api_keys/security/best_practices.html.erb
       # The view will contain the static content.
     end
+
+    private
+
+    # Check if key types feature is enabled
+    def key_types_feature_enabled?
+      ApiKeys.configuration.key_types.present? && ApiKeys.configuration.key_types.any?
+    end
   end
 end
diff --git a/app/views/api_keys/keys/_empty_state.html.erb b/app/views/api_keys/keys/_empty_state.html.erb
new file mode 100644
index 0000000..6f51828
--- /dev/null
+++ b/app/views/api_keys/keys/_empty_state.html.erb
@@ -0,0 +1,9 @@
+<%# Partial for displaying empty state when no keys exist %>
+<%# Locals: message (optional) - Custom message to display %>
+
+<% message ||= "You don't have any API keys yet!" %>
+
+<div class="api-keys-empty-state" style="text-align: center; padding: 2em;">
+  <h4><%= message %></h4>
+  <p>Create your first API key to get started.</p>
+</div>
diff --git a/app/views/api_keys/keys/_key_actions.html.erb b/app/views/api_keys/keys/_key_actions.html.erb
new file mode 100644
index 0000000..d397b66
--- /dev/null
+++ b/app/views/api_keys/keys/_key_actions.html.erb
@@ -0,0 +1,20 @@
+<%# Partial for displaying key action buttons (edit, revoke) %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<% if key.active? %>
+  <%= link_to api_keys.edit_key_path(key), title: "Edit Key", class: "api-keys-action-edit" do %>
+    <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M16.793 2.793a3.121 3.121 0 1 1 4.414 4.414l-8.5 8.5A1 1 0 0 1 12 16H9a1 1 0 0 1-1-1v-3a1 1 0 0 1 .293-.707l8.5-8.5Zm3 1.414a1.121 1.121 0 0 0-1.586 0L10 12.414V14h1.586l8.207-8.207a1.121 1.121 0 0 0 0-1.586ZM6 5a1 1 0 0 0-1 1v12a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v-4a1 1 0 1 1 2 0v4a3 3 0 0 1-3 3H6a3 3 0 0 1-3-3V6a3 3 0 0 1 3-3h4a1 1 0 1 1 0 2H6Z" clip-rule="evenodd"></path></svg>
+  <% end %>
+
+  <% if key.revocable? %>
+    <%= button_to api_keys.revoke_key_path(key), title: "Revoke Key", class: "api-keys-action-revoke", data: { turbo_method: :post, turbo_confirm: "Are you sure you want to revoke this key? It will stop working immediately." } do %>
+      <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M10.556 4a1 1 0 0 0-.97.751l-.292 1.14h5.421l-.293-1.14A1 1 0 0 0 13.453 4h-2.897Zm6.224 1.892-.421-1.639A3 3 0 0 0 13.453 2h-2.897A3 3 0 0 0 7.65 4.253l-.421 1.639H4a1 1 0 1 0 0 2h.1l1.215 11.425A3 3 0 0 0 8.3 22h7.4a3 3 0 0 0 2.984-2.683l1.214-11.425H20a1 1 0 1 0 0-2h-3.22Zm1.108 2H6.112l1.192 11.214A1 1 0 0 0 8.3 20h7.4a1 1 0 0 0 .995-.894l1.192-11.214ZM10 10a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Zm4 0a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Z" clip-rule="evenodd"></path></svg>
+    <% end %>
+  <% else %>
+    <span title="This key cannot be revoked" class="api-keys-action-disabled" style="color: var(--api-keys-muted-color); cursor: help;">
+      <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z" clip-rule="evenodd"></path></svg>
+    </span>
+  <% end %>
+<% else %>
+  &mdash;
+<% end %>
diff --git a/app/views/api_keys/keys/_key_badges.html.erb b/app/views/api_keys/keys/_key_badges.html.erb
new file mode 100644
index 0000000..b1dc24c
--- /dev/null
+++ b/app/views/api_keys/keys/_key_badges.html.erb
@@ -0,0 +1,17 @@
+<%# Partial for displaying key type and environment badges %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<% if key.key_type.present? %>
+  <% type_config = key.key_type_config %>
+  <% is_publishable = type_config&.dig(:revocable) == false %>
+  <span class="api-keys-badge api-keys-badge-type <%= is_publishable ? 'api-keys-badge-publishable' : 'api-keys-badge-secret' %>" style="display: inline-block; padding: 2px 6px; font-size: 0.75em; border-radius: 3px; background-color: var(<%= is_publishable ? '--api-keys-badge-publishable-bg' : '--api-keys-badge-secret-bg' %>); color: var(<%= is_publishable ? '--api-keys-badge-publishable-color' : '--api-keys-badge-secret-color' %>); margin-left: 4px;">
+    <%= key.key_type.humanize %>
+  </span>
+<% end %>
+
+<% if key.environment.present? %>
+  <% is_live = key.environment == 'live' %>
+  <span class="api-keys-badge api-keys-badge-env <%= is_live ? 'api-keys-badge-live' : 'api-keys-badge-test' %>" style="display: inline-block; padding: 2px 6px; font-size: 0.75em; border-radius: 3px; background-color: var(<%= is_live ? '--api-keys-badge-live-bg' : '--api-keys-badge-test-bg' %>); color: var(<%= is_live ? '--api-keys-badge-live-color' : '--api-keys-badge-test-color' %>); margin-left: 4px;">
+    <%= key.environment.upcase %>
+  </span>
+<% end %>
diff --git a/app/views/api_keys/keys/_key_row.html.erb b/app/views/api_keys/keys/_key_row.html.erb
index 60d518e..a83ac07 100644
--- a/app/views/api_keys/keys/_key_row.html.erb
+++ b/app/views/api_keys/keys/_key_row.html.erb
@@ -1,48 +1,25 @@
-<tr>
-  <td>
-    <%# Status indicator (no text originally, keeping it that way unless specified otherwise) %>
-    <% if key.active? %>
-      <span style="color: green;"></span>
-    <% elsif key.revoked? %>
-      <span style="color: orange;">[Revoked]</span>
-    <% elsif key.expired? %>
-      <span style="color: red;">[Expired]</span>
-    <% end %>
+<%# Partial for displaying a single API key row in the table %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<tr class="api-keys-row <%= 'api-keys-row-inactive' if defined?(inactive) && inactive %>">
+  <td class="api-keys-cell-name">
+    <%= render partial: 'api_keys/keys/key_status', locals: { key: key } %>
     <%= key.name.presence || (key.key_type.present? ? "#{key.key_type.humanize} key" : "API key") %>
-    <%# Key type and environment badges %>
-    <% if key.key_type.present? %>
-      <% type_config = key.key_type_config %>
-      <span style="display: inline-block; padding: 2px 6px; font-size: 0.75em; border-radius: 3px; background-color: <%= type_config&.dig(:revocable) == false ? '#fef3cd' : '#e7f1ff' %>; color: <%= type_config&.dig(:revocable) == false ? '#856404' : '#004085' %>; margin-left: 4px;">
-        <%= key.key_type.humanize %>
-      </span>
-    <% end %>
-    <% if key.environment.present? %>
-      <span style="display: inline-block; padding: 2px 6px; font-size: 0.75em; border-radius: 3px; background-color: <%= key.environment == 'live' ? '#d4edda' : '#f8d7da' %>; color: <%= key.environment == 'live' ? '#155724' : '#721c24' %>; margin-left: 4px;">
-        <%= key.environment.upcase %>
-      </span>
-    <% end %>
-  </td>
-  <td>
-    <code><%= key.masked_token %></code>
-    <% if key.public_key_type? && key.viewable_token.present? %>
-      <button type="button" onclick="this.nextElementSibling.style.display='inline'; this.style.display='none';" style="margin-left: 8px; font-size: 0.75em; padding: 2px 6px; cursor: pointer;" title="Show full token">Show</button>
-      <span style="display: none;">
-        <code style="word-break: break-all;"><%= key.viewable_token %></code>
-        <button type="button" onclick="navigator.clipboard.writeText('<%= key.viewable_token %>'); alert('Copied!');" style="margin-left: 4px; font-size: 0.75em; padding: 2px 6px; cursor: pointer;" title="Copy to clipboard">Copy</button>
-      </span>
-    <% end %>
+    <%= render partial: 'api_keys/keys/key_badges', locals: { key: key } %>
   </td>
 
+  <td class="api-keys-cell-token api-keys-token-cell">
+    <%= render partial: 'api_keys/keys/token_display', locals: { key: key } %>
+  </td>
 
-  <td title="<%= key.created_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
+  <td class="api-keys-cell-created" title="<%= key.created_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
     <%= time_ago_in_words(key.created_at) %> ago
   </td>
 
-
-  <td>
+  <td class="api-keys-cell-expires">
     <% if key.expires_at? %>
       <% if key.expired? %>
-        <strong style="color: red;" title="<%= key.expires_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
+        <strong style="color: var(--api-keys-status-expired-color);" title="<%= key.expires_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
           Expired <%= time_ago_in_words(key.expires_at) %> ago
         </strong>
       <% else %>
@@ -55,46 +32,27 @@
     <% end %>
   </td>
 
-
-  <td>
+  <td class="api-keys-cell-last-used">
     <% if key.last_used_at? %>
       <span title="<%= key.last_used_at.strftime('%Y-%m-%d %H:%M:%S %Z') %>">
         <%= time_ago_in_words(key.last_used_at) %> ago
       </span>
-      <%# TODO: Add relative time check (e.g., "within last 3 months") %>
     <% else %>
       <em>Never used</em>
     <% end %>
   </td>
 
-
-  <td>
+  <td class="api-keys-cell-scopes">
     <% if key.scopes.present? %>
       <% key.scopes.each do |scope| %>
-        <kbd class="tag is-small"><%= scope %></kbd>
+        <kbd class="api-keys-scope-tag tag is-small"><%= scope %></kbd>
       <% end %>
     <% else %>
       &mdash;
     <% end %>
   </td>
-  <td class="api-keys-action-buttons">
-    <% if key.active? %>
-      <%= link_to api_keys.edit_key_path(key), title: "Edit Key" do %>
-        <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M16.793 2.793a3.121 3.121 0 1 1 4.414 4.414l-8.5 8.5A1 1 0 0 1 12 16H9a1 1 0 0 1-1-1v-3a1 1 0 0 1 .293-.707l8.5-8.5Zm3 1.414a1.121 1.121 0 0 0-1.586 0L10 12.414V14h1.586l8.207-8.207a1.121 1.121 0 0 0 0-1.586ZM6 5a1 1 0 0 0-1 1v12a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v-4a1 1 0 1 1 2 0v4a3 3 0 0 1-3 3H6a3 3 0 0 1-3-3V6a3 3 0 0 1 3-3h4a1 1 0 1 1 0 2H6Z" clip-rule="evenodd"></path></svg>
-      <% end %>
-      <%# Only show revoke button for revocable keys %>
-      <% if key.revocable? %>
-        <%= button_to api_keys.revoke_key_path(key), title: "Revoke Key", data: { turbo_method: :post, turbo_confirm: "Are you sure you want to revoke this key? It will stop working immediately." } do %>
-          <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M10.556 4a1 1 0 0 0-.97.751l-.292 1.14h5.421l-.293-1.14A1 1 0 0 0 13.453 4h-2.897Zm6.224 1.892-.421-1.639A3 3 0 0 0 13.453 2h-2.897A3 3 0 0 0 7.65 4.253l-.421 1.639H4a1 1 0 1 0 0 2h.1l1.215 11.425A3 3 0 0 0 8.3 22h7.4a3 3 0 0 0 2.984-2.683l1.214-11.425H20a1 1 0 1 0 0-2h-3.22Zm1.108 2H6.112l1.192 11.214A1 1 0 0 0 8.3 20h7.4a1 1 0 0 0 .995-.894l1.192-11.214ZM10 10a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Zm4 0a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0v-5a1 1 0 0 1 1-1Z" clip-rule="evenodd"></path></svg>
-        <% end %>
-      <% else %>
-        <span title="This key cannot be revoked" style="color: #999; cursor: help;">
-          <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z" clip-rule="evenodd"></path></svg>
-        </span>
-      <% end %>
-    <% else %>
-      <%# No actions available for inactive/revoked/expired keys %>
-      &mdash;
-    <% end %>
+
+  <td class="api-keys-cell-actions api-keys-action-buttons">
+    <%= render partial: 'api_keys/keys/key_actions', locals: { key: key } %>
   </td>
-</tr>
\ No newline at end of file
+</tr>
diff --git a/app/views/api_keys/keys/_key_status.html.erb b/app/views/api_keys/keys/_key_status.html.erb
new file mode 100644
index 0000000..d55b904
--- /dev/null
+++ b/app/views/api_keys/keys/_key_status.html.erb
@@ -0,0 +1,10 @@
+<%# Partial for displaying key status indicator %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<% if key.active? %>
+  <span class="api-keys-status api-keys-status-active" style="color: var(--api-keys-status-active-color);"></span>
+<% elsif key.revoked? %>
+  <span class="api-keys-status api-keys-status-revoked" style="color: var(--api-keys-status-revoked-color);">[Revoked]</span>
+<% elsif key.expired? %>
+  <span class="api-keys-status api-keys-status-expired" style="color: var(--api-keys-status-expired-color);">[Expired]</span>
+<% end %>
diff --git a/app/views/api_keys/keys/_keys_table.html.erb b/app/views/api_keys/keys/_keys_table.html.erb
index 683b0e4..15845ee 100644
--- a/app/views/api_keys/keys/_keys_table.html.erb
+++ b/app/views/api_keys/keys/_keys_table.html.erb
@@ -38,12 +38,7 @@
         </tbody>
       </table>
     <% else %>
-      <div style="text-align: center; padding: 2em;">
-        <h4>You don't have any API keys yet!</h4>
-        <p>Create your first API key to get started.</p>
-        <%# Consider adding a primary "Create Key" button here %>
-        <%#= link_to "Create New API Key", new_key_path, class: "button primary" %>
-      </div>
+      <%= render partial: 'api_keys/keys/empty_state' %>
     <% end %>
   </div>
 
diff --git a/app/views/api_keys/keys/_publishable_keys.html.erb b/app/views/api_keys/keys/_publishable_keys.html.erb
new file mode 100644
index 0000000..b70deaf
--- /dev/null
+++ b/app/views/api_keys/keys/_publishable_keys.html.erb
@@ -0,0 +1,40 @@
+<%# Partial for displaying publishable keys section %>
+<%# Locals: active_keys (Active publishable keys), inactive_keys (Inactive publishable keys) %>
+
+<section class="api-keys-section api-keys-publishable-section" aria-labelledby="publishable-keys-heading">
+  <h2 id="publishable-keys-heading">Publishable Keys</h2>
+  <p class="api-keys-section-description">
+    These keys are safe to embed in client-side applications and browser code.
+    You can view them anytime.
+  </p>
+
+  <div class="api-keys-table-wrapper">
+    <% all_keys = active_keys + inactive_keys %>
+    <% if all_keys.any? %>
+      <table>
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>API Key</th>
+            <th>Created</th>
+            <th>Expires</th>
+            <th>Last Used</th>
+            <th>Permissions</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <% active_keys.each do |key| %>
+            <%= render partial: 'api_keys/keys/key_row', locals: { key: key } %>
+          <% end %>
+
+          <% inactive_keys.each do |key| %>
+            <%= render partial: 'api_keys/keys/key_row', locals: { key: key, inactive: true } %>
+          <% end %>
+        </tbody>
+      </table>
+    <% else %>
+      <%= render partial: 'api_keys/keys/empty_state', locals: { message: "No publishable keys yet." } %>
+    <% end %>
+  </div>
+</section>
diff --git a/app/views/api_keys/keys/_secret_keys.html.erb b/app/views/api_keys/keys/_secret_keys.html.erb
new file mode 100644
index 0000000..335809f
--- /dev/null
+++ b/app/views/api_keys/keys/_secret_keys.html.erb
@@ -0,0 +1,39 @@
+<%# Partial for displaying secret keys section %>
+<%# Locals: active_keys (Active secret keys), inactive_keys (Inactive secret keys) %>
+
+<section class="api-keys-section api-keys-secret-section" aria-labelledby="secret-keys-heading">
+  <h2 id="secret-keys-heading">Secret Keys</h2>
+  <p class="api-keys-section-description">
+    Keep these private. Never expose in client-side code or share publicly.
+  </p>
+
+  <div class="api-keys-table-wrapper">
+    <% all_keys = active_keys + inactive_keys %>
+    <% if all_keys.any? %>
+      <table>
+        <thead>
+          <tr>
+            <th>Name</th>
+            <th>API Key</th>
+            <th>Created</th>
+            <th>Expires</th>
+            <th>Last Used</th>
+            <th>Permissions</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          <% active_keys.each do |key| %>
+            <%= render partial: 'api_keys/keys/key_row', locals: { key: key } %>
+          <% end %>
+
+          <% inactive_keys.each do |key| %>
+            <%= render partial: 'api_keys/keys/key_row', locals: { key: key, inactive: true } %>
+          <% end %>
+        </tbody>
+      </table>
+    <% else %>
+      <%= render partial: 'api_keys/keys/empty_state', locals: { message: "No secret keys yet." } %>
+    <% end %>
+  </div>
+</section>
diff --git a/app/views/api_keys/keys/_token_display.html.erb b/app/views/api_keys/keys/_token_display.html.erb
new file mode 100644
index 0000000..847d3f7
--- /dev/null
+++ b/app/views/api_keys/keys/_token_display.html.erb
@@ -0,0 +1,11 @@
+<%# Partial for displaying an API key token with optional show/copy functionality %>
+<%# Locals: key (required) - The ApiKey record %>
+
+<% if key.public_key_type? && key.viewable_token.present? %>
+  <span class="token-masked"><code><%= key.masked_token %></code></span>
+  <span class="token-full" style="display: none;"><code style="word-break: break-all;"><%= key.viewable_token %></code></span>
+  <button type="button" class="btn-show-token" style="margin-left: 8px; font-size: 0.75em; padding: 2px 6px; cursor: pointer;" title="Show full token">Show</button>
+  <button type="button" class="btn-copy-token" style="display: none; margin-left: 4px; font-size: 0.75em; padding: 2px 6px; cursor: pointer;" title="Copy to clipboard" data-token="<%= key.viewable_token %>">Copy</button>
+<% else %>
+  <code><%= key.masked_token %></code>
+<% end %>
diff --git a/app/views/api_keys/keys/index.html.erb b/app/views/api_keys/keys/index.html.erb
index b976ea4..ef04313 100644
--- a/app/views/api_keys/keys/index.html.erb
+++ b/app/views/api_keys/keys/index.html.erb
@@ -15,12 +15,44 @@
 
 <div>
 
-  <p>Do not share your API key with others or expose it in the browser or other client-side code. <%= link_to api_keys.security_best_practices_path, class: "text-primary api-keys-align-center" do %>
-    Learn more&nbsp;
-    <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M15 5a1 1 0 1 1 0-2h5a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0V6.414l-5.293 5.293a1 1 0 0 1-1.414-1.414L17.586 5H15ZM4 7a3 3 0 0 1 3-3h3a1 1 0 1 1 0 2H7a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1v-3a1 1 0 1 1 2 0v3a3 3 0 0 1-3 3H7a3 3 0 0 1-3-3V7Z" clip-rule="evenodd"></path></svg>
-  <% end %>
+  <% if key_types_feature_enabled? %>
+    <% has_publishable_keys = @publishable_keys.any? || @inactive_publishable_keys.any? %>
+
+    <p class="api-keys-info-text">
+      <% if has_publishable_keys %>
+        <strong>Secret keys</strong> should never be shared or exposed publicly.
+        <strong>Publishable keys</strong> can be safely embedded in client applications.
+      <% else %>
+        Do not share your API key with others or expose it in the browser or other client-side code.
+      <% end %>
+      <%= link_to api_keys.security_best_practices_path, class: "text-primary api-keys-align-center" do %>
+        Learn more&nbsp;
+        <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M15 5a1 1 0 1 1 0-2h5a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0V6.414l-5.293 5.293a1 1 0 0 1-1.414-1.414L17.586 5H15ZM4 7a3 3 0 0 1 3-3h3a1 1 0 1 1 0 2H7a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1v-3a1 1 0 1 1 2 0v3a3 3 0 0 1-3 3H7a3 3 0 0 1-3-3V7Z" clip-rule="evenodd"></path></svg>
+      <% end %>
+    </p>
 
-  <%# Render the reusable table partial %>
-  <%= render partial: 'keys_table', locals: { active_keys: @api_keys, inactive_keys: @inactive_api_keys } %>
+    <%# Render secret keys section first (primary use case) %>
+    <%= render partial: 'secret_keys', locals: {
+      active_keys: @secret_keys,
+      inactive_keys: @inactive_secret_keys
+    } %>
+
+    <%# Only render publishable keys section if there are any %>
+    <% if has_publishable_keys %>
+      <%= render partial: 'publishable_keys', locals: {
+        active_keys: @publishable_keys,
+        inactive_keys: @inactive_publishable_keys
+      } %>
+    <% end %>
+
+  <% else %>
+    <p>Do not share your API key with others or expose it in the browser or other client-side code. <%= link_to api_keys.security_best_practices_path, class: "text-primary api-keys-align-center" do %>
+      Learn more&nbsp;
+      <svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M15 5a1 1 0 1 1 0-2h5a1 1 0 0 1 1 1v5a1 1 0 1 1-2 0V6.414l-5.293 5.293a1 1 0 0 1-1.414-1.414L17.586 5H15ZM4 7a3 3 0 0 1 3-3h3a1 1 0 1 1 0 2H7a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h10a1 1 0 0 0 1-1v-3a1 1 0 1 1 2 0v3a3 3 0 0 1-3 3H7a3 3 0 0 1-3-3V7Z" clip-rule="evenodd"></path></svg>
+    <% end %>
+
+    <%# Render the reusable table partial (legacy mode - single table) %>
+    <%= render partial: 'keys_table', locals: { active_keys: @api_keys, inactive_keys: @inactive_api_keys } %>
+  <% end %>
 
-</div>
\ No newline at end of file
+</div>
diff --git a/app/views/api_keys/security/best_practices.html.erb b/app/views/api_keys/security/best_practices.html.erb
index 280648e..48e608f 100644
--- a/app/views/api_keys/security/best_practices.html.erb
+++ b/app/views/api_keys/security/best_practices.html.erb
@@ -1,70 +1,96 @@
 <header>
-  <h1>API Key Security Best Practices</h1>
-  <p>Protecting your API keys is crucial for maintaining the security and integrity of your account and data.</p>
+  <h1>API Key Security</h1>
+  <p>Protecting your API keys is crucial for maintaining the security of your account and data.</p>
 </header>
 
-<article class="col-5">
+<article class="col-8">
 
-  <section>
-    <h3>1. Treat API Keys Like Passwords</h3>
-    <p>Your API keys grant access to your account and potentially sensitive operations. Handle them with the same level of security you would apply to your account password or other critical credentials.</p>
-  </section>
+  <% if key_types_feature_enabled? %>
+    <section class="api-keys-section">
+      <h2>Understanding Key Types</h2>
 
-  <section>
-    <h3>2. Use Unique Keys for Different Applications & Environments</h3>
-    <p>Generate distinct API keys for different applications, services, or integrations that need access. If a key for one application is compromised, you can revoke it without disrupting others. Use separate keys for development, staging, and production environments.</p>
-    <p><em>Tip:</em> Use the "Name" field when creating keys to easily identify their purpose (e.g., "Production Zapier Integration", "Staging iOS App").</p>
-  </section>
+      <h3>Secret Keys</h3>
+      <p>Secret keys provide full access to your account and should be treated like passwords.</p>
+      <ul>
+        <li><strong>Never expose</strong> in client-side code (browsers, mobile apps, desktop apps)</li>
+        <li><strong>Never commit</strong> to version control (Git, etc.)</li>
+        <li><strong>Store securely</strong> using environment variables or secrets management</li>
+        <li><strong>Can be revoked</strong> immediately if compromised</li>
+      </ul>
 
-  <section>
-    <h3>3. Never Expose Keys in Client-Side Code</h3>
-    <p><strong>Never</strong> embed API keys directly in mobile apps (iOS, Android), browser-side JavaScript, desktop applications, or any code that resides on a user's device. Exposed keys can be easily extracted by malicious actors.</p>
-    <p><strong>Solution:</strong> Route API requests through your own backend server. Your server can securely store and use the API key to communicate with the target API on behalf of the client.</p>
-  </section>
+      <h3>Publishable Keys</h3>
+      <p>Publishable keys are designed for client-side use with limited, safe permissions.</p>
+      <ul>
+        <li><strong>Safe to embed</strong> in browser JavaScript, mobile apps, and public code</li>
+        <li><strong>Limited access</strong> &mdash; cannot perform sensitive operations</li>
+        <li><strong>Always visible</strong> &mdash; you can view the full key anytime in your dashboard</li>
+        <li><strong>Cannot be revoked</strong> &mdash; designed to be long-lived identifiers</li>
+      </ul>
+    </section>
+  <% end %>
 
   <section>
-    <h3>4. Never Commit Keys to Version Control (e.g., Git)</h3>
-    <p>Committing keys to your source code repository (like Git, Mercurial, etc.) is a common and dangerous mistake. Even in private repositories, accidental pushes or repository breaches can leak your keys.</p>
-    <p><strong>Solution:</strong> Store keys in environment variables or use a dedicated secrets management system. Access the key in your code via these secure methods.</p>
-  </section>
+    <h2>Essential Practices</h2>
 
-  <section>
-    <h3>5. Securely Store Keys on Your Backend</h3>
-    <ul>
-      <li><strong>Environment Variables:</strong> The simplest secure method for many applications. Set an environment variable (e.g., `YOUR_SERVICE_API_KEY`) on your server and access it in your code (e.g., `ENV['YOUR_SERVICE_API_KEY']` in Ruby/Rails).</li>
-      <li><strong>Secrets Management Services:</strong> For more robust needs, especially in production or team environments, use dedicated services like HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, Doppler, etc. These provide encrypted storage, access control, auditing, and often automated rotation capabilities.</li>
-      <li><strong>Encrypted Configuration Files:</strong> If using configuration files, ensure they are encrypted (e.g., Rails encrypted credentials `config/credentials.yml.enc` and `Rails.application.credentials`). <%= link_to "More info here", "https://guides.rubyonrails.org/security.html#custom-credentials", target: "_blank", rel: "noopener noreferrer", class: "text-primary" %>.</li>
-    </ul>
+    <h3>Treat Secret Keys Like Passwords</h3>
+    <p>Your API keys grant access to your account. Handle them with the same care you would apply to your account password.</p>
+
+    <h3>Use Separate Keys for Different Purposes</h3>
+    <p>Create distinct keys for different applications and environments. If one key is compromised, you can revoke it without disrupting others.</p>
+    <p><em>Tip:</em> Use descriptive names like "Production Backend" or "Staging iOS App" to easily identify each key's purpose.</p>
+
+    <% unless key_types_feature_enabled? %>
+      <h3>Never Expose Keys in Client-Side Code</h3>
+      <p><strong>Never</strong> embed API keys in mobile apps, browser JavaScript, or desktop applications. Exposed keys can be easily extracted by malicious actors.</p>
+      <p><strong>Solution:</strong> Route API requests through your own backend server, which can securely store and use the API key.</p>
+    <% end %>
   </section>
 
   <section>
-    <h3>6. Implement the Principle of Least Privilege (Scopes)</h3>
-    <p>If the API service supports it (and this `api_keys` gem allows for scopes), create keys with only the minimum permissions (scopes) required for their specific task. Avoid using a key with full access if only read access is needed.</p>
-    <p><em>Note:</em> Scope availability and enforcement depend on how the host application integrates and utilizes the `scopes` attribute provided by this gem.</p>
+    <h2>Secure Storage</h2>
+
+    <h3>Environment Variables</h3>
+    <p>The simplest secure method. Set an environment variable on your server:</p>
+    <pre><code># In your shell or deployment config
+export YOUR_SERVICE_API_KEY="sk_..."
+
+# Access in Ruby
+ENV['YOUR_SERVICE_API_KEY']</code></pre>
+
+    <h3>Rails Encrypted Credentials</h3>
+    <p>For Rails applications, use encrypted credentials:</p>
+    <pre><code># Edit credentials
+bin/rails credentials:edit
+
+# Access in code
+Rails.application.credentials.your_service_api_key</code></pre>
+    <p><%= link_to "Rails Security Guide", "https://guides.rubyonrails.org/security.html#custom-credentials", target: "_blank", rel: "noopener noreferrer", class: "text-primary" %></p>
+
+    <h3>Secrets Management Services</h3>
+    <p>For production environments, consider dedicated services like HashiCorp Vault, AWS Secrets Manager, or Google Secret Manager.</p>
   </section>
 
   <section>
-    <h3>7. Monitor Usage and Rotate Keys Regularly</h3>
-    <ul>
-      <li><strong>Monitor Usage:</strong> Regularly check API usage logs or dashboards (if provided by the service or your monitoring tools). Look for unexpected spikes in activity or requests from unusual locations, which could indicate a compromised key.</li>
-      <li><strong>Rotate Keys:</strong> Periodically generate new keys and revoke old ones (key rotation). This limits the window of opportunity for attackers if a key is ever leaked undetected. How often you rotate depends on your security requirements (e.g., every 90 days, annually).
-        <br><em>Tip:</em> This dashboard allows creating multiple keys, facilitating rotation. Create a new key, update your application(s), verify they work, and then revoke the old key.</li>
-      <li><strong>Revoke Immediately if Compromised:</strong> If you suspect a key has been leaked or compromised, revoke it immediately using the "Revoke" button on your keys dashboard.</li>
-    </ul>
+    <h2>Monitoring &amp; Rotation</h2>
+
+    <h3>Monitor Usage</h3>
+    <p>Regularly check for unexpected activity spikes or requests from unusual locations, which could indicate a compromised key.</p>
+
+    <h3>Rotate Keys Periodically</h3>
+    <p>Generate new keys and revoke old ones on a regular schedule (e.g., every 90 days). This limits exposure if a key is leaked undetected.</p>
+    <p><em>Tip:</em> Create a new key first, update your application, verify it works, then revoke the old key.</p>
+
+    <h3>Revoke Immediately if Compromised</h3>
+    <p>If you suspect a key has been leaked, revoke it immediately from your dashboard.</p>
   </section>
 
   <section>
-    <h3>8. Use HTTPS Exclusively</h3>
-    <p>Ensure all API requests are made over HTTPS to encrypt the connection and prevent eavesdropping. Transmitting keys over unencrypted HTTP is highly insecure.</p>
+    <h2>Always Use HTTPS</h2>
+    <p>Ensure all API requests are made over HTTPS. Transmitting keys over unencrypted HTTP exposes them to eavesdropping.</p>
   </section>
 
   <hr>
 
-  <p>By following these best practices, you significantly reduce the risk associated with API key management.</p>
-
-  <%# Link back to the keys index if appropriate %>
-  <% if defined?(api_keys.keys_path) %>
-    <p><%= link_to "Back to API Keys", api_keys.keys_path, class: "text-primary" %></p>
-  <% end %>
+  <p><%= link_to "Back to API Keys", api_keys.keys_path, class: "text-primary" %></p>
 
-</article>
\ No newline at end of file
+</article>
diff --git a/app/views/layouts/api_keys/application.html.erb b/app/views/layouts/api_keys/application.html.erb
index 7369ff3..b4b5cef 100644
--- a/app/views/layouts/api_keys/application.html.erb
+++ b/app/views/layouts/api_keys/application.html.erb
@@ -12,15 +12,67 @@
 </head>
 <body>
   <style>
+    /*
+     * API Keys CSS Variables
+     * Override these in your host application to customize the dashboard appearance.
+     * Example in your app's CSS:
+     *   :root {
+     *     --api-keys-primary-color: #your-brand-color;
+     *     --api-keys-danger-color: #your-danger-color;
+     *   }
+     */
+    :root {
+      /* Colors */
+      --api-keys-primary-color: #007bff;
+      --api-keys-danger-color: #c23539;
+      --api-keys-success-color: #28a745;
+      --api-keys-warning-color: #ffc107;
+      --api-keys-muted-color: #6c757d;
+
+      /* Badge colors */
+      --api-keys-badge-secret-bg: #e7f1ff;
+      --api-keys-badge-secret-color: #004085;
+      --api-keys-badge-publishable-bg: #fef3cd;
+      --api-keys-badge-publishable-color: #856404;
+      --api-keys-badge-live-bg: #d4edda;
+      --api-keys-badge-live-color: #155724;
+      --api-keys-badge-test-bg: #f8d7da;
+      --api-keys-badge-test-color: #721c24;
+
+      /* Status colors */
+      --api-keys-status-active-color: green;
+      --api-keys-status-revoked-color: orange;
+      --api-keys-status-expired-color: red;
+
+      /* Spacing */
+      --api-keys-section-padding: 1.5em;
+      --api-keys-section-margin: 2em;
+      --api-keys-border-radius: 8px;
+
+      /* Typography */
+      --api-keys-font-family: inherit;
+      --api-keys-code-font-size: 0.8em;
+    }
+
     body {
-      /* grid-template-columns: 1fr min(100rem, 90%) 1fr !important; */
+      font-family: var(--api-keys-font-family);
     }
 
     @media (prefers-color-scheme: dark) {
+      :root {
+        --api-keys-badge-secret-bg: #1a365d;
+        --api-keys-badge-secret-color: #90cdf4;
+        --api-keys-badge-publishable-bg: #744210;
+        --api-keys-badge-publishable-color: #faf089;
+        --api-keys-badge-live-bg: #22543d;
+        --api-keys-badge-live-color: #9ae6b4;
+        --api-keys-badge-test-bg: #742a2a;
+        --api-keys-badge-test-color: #feb2b2;
+      }
+
       body {
-        /* Define dark mode variables directly */
-        --bg-color:rgb(14, 14, 14);
-        --bg-secondary-color:rgb(34, 34, 34);
+        --bg-color: rgb(14, 14, 14);
+        --bg-secondary-color: rgb(34, 34, 34);
         --font-color: #f5f5f5;
         --color-grey: #ccc;
         --color-darkGrey: #777;
@@ -29,7 +81,7 @@
 
     code, pre {
       color: var(--font-color);
-      font-size: 0.8em;
+      font-size: var(--api-keys-code-font-size);
     }
 
     .api-keys-align-center {
@@ -52,7 +104,7 @@
     .api-keys-action-buttons button {
       background: none;
       padding: 0;
-      color: #c23539
+      color: var(--api-keys-danger-color);
     }
 
     .api-keys-button-text {
@@ -77,6 +129,38 @@
       margin-top: 2.4em;
     }
 
+    /* API Keys sections styling */
+    .api-keys-section {
+      margin-top: var(--api-keys-section-margin);
+      padding: var(--api-keys-section-padding);
+      border: 1px solid var(--color-grey, #ccc);
+      border-radius: var(--api-keys-border-radius);
+      background-color: var(--bg-secondary-color, #f9f9f9);
+    }
+
+    .api-keys-section h2 {
+      margin-top: 0;
+      margin-bottom: 0.5em;
+      font-size: 1.25em;
+    }
+
+    .api-keys-section-description {
+      margin-bottom: 1em;
+      color: var(--color-darkGrey, #666);
+      font-size: 0.9em;
+    }
+
+    .api-keys-info-text {
+      margin-bottom: 1em;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      .api-keys-section {
+        background-color: var(--bg-secondary-color, rgb(34, 34, 34));
+        border-color: var(--color-darkGrey, #555);
+      }
+    }
+
   </style>
 
   <nav class="nav container">
@@ -109,7 +193,29 @@
     <%# Footer content %>
   </footer>
 
-  <%# Add any necessary JS includes if needed later %>
+  <script>
+    // Minimal JS for API Keys dashboard - event delegation for show/copy tokens
+    document.addEventListener('click', function(e) {
+      // Show token (one-way: masked -> full, no hiding back)
+      if (e.target.matches('.btn-show-token')) {
+        var cell = e.target.closest('td');
+        cell.querySelector('.token-masked').style.display = 'none';
+        cell.querySelector('.token-full').style.display = 'inline';
+        e.target.style.display = 'none';
+        cell.querySelector('.btn-copy-token').style.display = 'inline';
+      }
+
+      // Copy token to clipboard
+      if (e.target.matches('.btn-copy-token')) {
+        var token = e.target.getAttribute('data-token');
+        navigator.clipboard.writeText(token).then(function() {
+          var originalText = e.target.textContent;
+          e.target.textContent = 'Copied!';
+          setTimeout(function() { e.target.textContent = originalText; }, 2000);
+        });
+      }
+    });
+  </script>
 
 </body>
 </html> 
\ No newline at end of file
diff --git a/lib/api_keys.rb b/lib/api_keys.rb
index 3abc5c8..1e55bd5 100644
--- a/lib/api_keys.rb
+++ b/lib/api_keys.rb
@@ -60,6 +60,17 @@ def reset_configuration!
 require "api_keys/models/concerns/has_api_keys"
 require "api_keys/models/api_key"
 
+# Helpers for integrators building custom UIs
+require "api_keys/helpers/token_session"
+require "api_keys/helpers/expiration_options"
+require "api_keys/helpers/view_helpers"
+require "api_keys/form_builder_extensions"
+
+# Top-level aliases for cleaner API (ApiKeys::TokenSession instead of ApiKeys::Helpers::TokenSession)
+ApiKeys::TokenSession = ApiKeys::Helpers::TokenSession
+ApiKeys::ExpirationOptions = ApiKeys::Helpers::ExpirationOptions
+ApiKeys::ViewHelpers = ApiKeys::Helpers::ViewHelpers
+
 # Rails integration (Engine)
 # The Engine might also access ApiKeys.configuration during its initialization.
 require "api_keys/engine" if defined?(Rails)
diff --git a/lib/api_keys/form_builder_extensions.rb b/lib/api_keys/form_builder_extensions.rb
new file mode 100644
index 0000000..4bb0be5
--- /dev/null
+++ b/lib/api_keys/form_builder_extensions.rb
@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+module ApiKeys
+  # Opt-in form builder extensions for API key forms.
+  #
+  # These helpers reduce boilerplate while letting you control the styling.
+  # Include them in your form builder to use:
+  #
+  #   # In config/initializers/api_keys.rb:
+  #   Rails.application.config.to_prepare do
+  #     ActionView::Helpers::FormBuilder.include(ApiKeys::FormBuilderExtensions)
+  #   end
+  #
+  # @example Expiration select
+  #   <%= form.api_key_expiration_select(class: "my-select-class") %>
+  #
+  # @example Scopes checkboxes with block for custom rendering
+  #   <%= form.api_key_scopes_checkboxes(@scopes) do |scope, checked| %>
+  #     <label>
+  #       <%= check_box_tag "api_key[scopes][]", scope, checked, class: "my-checkbox" %>
+  #       <%= scope %>
+  #     </label>
+  #   <% end %>
+  #
+  module FormBuilderExtensions
+    # Renders a select field for API key expiration presets.
+    #
+    # @param options [Hash] Options passed to the select helper
+    # @param html_options [Hash] HTML attributes for the select element
+    # @return [String] HTML select element
+    #
+    # @example Basic usage
+    #   <%= form.api_key_expiration_select %>
+    #
+    # @example With Tailwind classes
+    #   <%= form.api_key_expiration_select(class: "w-full px-4 py-3 border rounded-lg") %>
+    #
+    # @example With custom default
+    #   <%= form.api_key_expiration_select(selected: "30_days") %>
+    #
+    def api_key_expiration_select(options = {}, html_options = {})
+      # expires_at_preset is a form-only param, not a model attribute
+      # So we only use the provided :selected option or default
+      selected = options.delete(:selected) || ApiKeys::ExpirationOptions.default_value
+
+      select(
+        :expires_at_preset,
+        @template.options_for_select(ApiKeys::ExpirationOptions.for_select, selected),
+        options,
+        html_options
+      )
+    end
+
+    # Renders checkboxes for API key scopes.
+    #
+    # If a block is given, yields each scope and its checked state for custom rendering.
+    # If no block is given, returns an array of checkbox data for manual iteration.
+    #
+    # @param scopes [Array<String>] Available scopes to render
+    # @param checked [Symbol, Array] Which scopes should be checked:
+    #   - :all (default for new records) - all scopes checked
+    #   - :none - no scopes checked
+    #   - Array - specific scopes to check
+    #   - nil - uses the object's current scopes
+    # @return [String, Array] HTML if block given, otherwise array of scope data
+    #
+    # @example With block (recommended for custom styling)
+    #   <%= form.api_key_scopes_checkboxes(@scopes) do |scope, checked| %>
+    #     <label class="flex items-center gap-2">
+    #       <%= check_box_tag "api_key[scopes][]", scope, checked, class: "rounded" %>
+    #       <code><%= scope %></code>
+    #     </label>
+    #   <% end %>
+    #
+    # @example Simple rendering without block
+    #   <% form.api_key_scopes_checkboxes(@scopes).each do |scope_data| %>
+    #     <%= check_box_tag "api_key[scopes][]", scope_data[:value], scope_data[:checked] %>
+    #     <%= scope_data[:value] %>
+    #   <% end %>
+    #
+    def api_key_scopes_checkboxes(scopes, checked: nil, &block)
+      # Determine which scopes should be checked
+      checked_scopes = resolve_checked_scopes(scopes, checked)
+
+      scope_data = scopes.map do |scope|
+        {
+          value: scope,
+          checked: checked_scopes.include?(scope),
+          field_name: "#{object_name}[scopes][]"
+        }
+      end
+
+      if block_given?
+        # Yield each scope for custom rendering
+        safe_buffer = ActiveSupport::SafeBuffer.new
+        scope_data.each do |data|
+          safe_buffer << @template.capture { yield(data[:value], data[:checked]) }
+        end
+        safe_buffer
+      else
+        # Return raw data for manual iteration
+        scope_data
+      end
+    end
+
+    # Returns structured data for building a token display UI.
+    # Useful when you need to build a custom token display with copy functionality.
+    #
+    # @return [Hash] Token display data with keys:
+    #   - :masked [String] The masked token (e.g., "sk_live_••••abc")
+    #   - :full [String, nil] The full token (only for viewable public keys)
+    #   - :viewable [Boolean] Whether the full token can be displayed
+    #   - :type [Symbol] The key type (:publishable, :secret, or nil)
+    #   - :environment [String, nil] The environment (e.g., "live", "test")
+    #
+    # @example
+    #   <% data = form.api_key_token_data %>
+    #   <code><%= data[:masked] %></code>
+    #   <% if data[:viewable] %>
+    #     <button data-token="<%= data[:full] %>">Copy</button>
+    #   <% end %>
+    #
+    def api_key_token_data
+      return {} unless object.respond_to?(:masked_token)
+
+      {
+        masked: object.masked_token,
+        full: object.viewable_token,
+        viewable: object.respond_to?(:public_key_type?) && object.public_key_type?,
+        type: object.key_type&.to_sym,
+        environment: object.environment
+      }
+    end
+
+    private
+
+    def resolve_checked_scopes(scopes, checked)
+      case checked
+      when :all
+        scopes.map(&:to_s)
+      when :none
+        []
+      when Array
+        checked.map(&:to_s)
+      when nil
+        # For new records, default to all checked
+        # For existing records, use the object's scopes
+        if object&.persisted?
+          (object.scopes || []).map(&:to_s)
+        else
+          scopes.map(&:to_s)
+        end
+      else
+        scopes.map(&:to_s)
+      end
+    end
+  end
+end
diff --git a/lib/api_keys/helpers/expiration_options.rb b/lib/api_keys/helpers/expiration_options.rb
new file mode 100644
index 0000000..0f6b758
--- /dev/null
+++ b/lib/api_keys/helpers/expiration_options.rb
@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+module ApiKeys
+  module Helpers
+    # Helper for handling API key expiration presets.
+    #
+    # Provides a consistent set of expiration options for use in forms,
+    # and parsing logic to convert preset strings to actual dates.
+    #
+    # @example In your view (form select)
+    #   <%= form.select :expires_at_preset,
+    #       ApiKeys::Helpers::ExpirationOptions.for_select %>
+    #
+    # @example In your controller
+    #   expires_at = ApiKeys::Helpers::ExpirationOptions.parse(params[:expires_at_preset])
+    #   @api_key = current_org.create_api_key!(expires_at: expires_at, ...)
+    #
+    class ExpirationOptions
+      # Default preset options with human-readable labels
+      DEFAULT_PRESETS = [
+        { label: "No Expiration", value: "no_expiration", days: nil },
+        { label: "7 days", value: "7_days", days: 7 },
+        { label: "30 days", value: "30_days", days: 30 },
+        { label: "60 days", value: "60_days", days: 60 },
+        { label: "90 days", value: "90_days", days: 90 },
+        { label: "1 year", value: "365_days", days: 365 }
+      ].freeze
+
+      class << self
+        # Returns options suitable for a Rails select helper.
+        #
+        # @param include_no_expiration [Boolean] Whether to include "No Expiration" option (default: true)
+        # @param presets [Array<Integer>, nil] Custom list of days to include (e.g., [7, 30, 90])
+        #   If nil, uses DEFAULT_PRESETS
+        # @return [Array<Array>] Array of [label, value] pairs for select helper
+        #
+        # @example Default options
+        #   ExpirationOptions.for_select
+        #   # => [["No Expiration", "no_expiration"], ["7 days", "7_days"], ...]
+        #
+        # @example Custom presets
+        #   ExpirationOptions.for_select(presets: [7, 30, 365])
+        #   # => [["No Expiration", "no_expiration"], ["7 days", "7_days"], ["30 days", "30_days"], ["1 year", "365_days"]]
+        #
+        # @example Without "No Expiration"
+        #   ExpirationOptions.for_select(include_no_expiration: false)
+        #   # => [["7 days", "7_days"], ["30 days", "30_days"], ...]
+        #
+        def for_select(include_no_expiration: true, presets: nil)
+          options = if presets
+                      build_custom_presets(presets, include_no_expiration)
+                    else
+                      filter_default_presets(include_no_expiration)
+                    end
+
+          options.map { |opt| [opt[:label], opt[:value]] }
+        end
+
+        # Parse an expiration preset string into an actual datetime.
+        #
+        # @param preset [String, nil] The preset value (e.g., "30_days", "no_expiration")
+        # @return [ActiveSupport::TimeWithZone, nil] The expiration date, or nil for no expiration
+        #
+        # @example
+        #   ExpirationOptions.parse("30_days")  # => 30.days.from_now
+        #   ExpirationOptions.parse("no_expiration")  # => nil
+        #   ExpirationOptions.parse(nil)  # => nil
+        #   ExpirationOptions.parse("invalid")  # => nil
+        #
+        def parse(preset)
+          return nil if preset.blank? || preset == "no_expiration"
+
+          # Try to extract days from the preset string (e.g., "30_days" => 30)
+          if preset =~ /\A(\d+)_days?\z/
+            days = ::Regexp.last_match(1).to_i
+            # Reasonable max: ~10 years to prevent overflow issues
+            return days.days.from_now if days.positive? && days <= 3650
+          end
+
+          # Check against known presets
+          known = DEFAULT_PRESETS.find { |p| p[:value] == preset }
+          return known[:days].days.from_now if known && known[:days]
+
+          nil
+        end
+
+        # Returns the default preset value (useful for form defaults)
+        #
+        # @return [String] The default preset value
+        def default_value
+          "no_expiration"
+        end
+
+        private
+
+        def filter_default_presets(include_no_expiration)
+          if include_no_expiration
+            DEFAULT_PRESETS
+          else
+            DEFAULT_PRESETS.reject { |p| p[:value] == "no_expiration" }
+          end
+        end
+
+        def build_custom_presets(days_list, include_no_expiration)
+          options = []
+
+          if include_no_expiration
+            options << { label: "No Expiration", value: "no_expiration", days: nil }
+          end
+
+          days_list.each do |days|
+            options << preset_for_days(days)
+          end
+
+          options
+        end
+
+        def preset_for_days(days)
+          label = case days
+                  when 1 then "1 day"
+                  when 365 then "1 year"
+                  when ->(d) { d % 365 == 0 } then "#{days / 365} years"
+                  else "#{days} days"
+                  end
+
+          { label: label, value: "#{days}_days", days: days }
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api_keys/helpers/token_session.rb b/lib/api_keys/helpers/token_session.rb
new file mode 100644
index 0000000..ec8a7d8
--- /dev/null
+++ b/lib/api_keys/helpers/token_session.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module ApiKeys
+  module Helpers
+    # Helper for managing API key tokens in the session.
+    #
+    # Secret keys can only be shown once (immediately after creation) because
+    # the plaintext token is not stored in the database. This helper provides
+    # a clean interface for the "show token once" pattern:
+    #
+    # 1. After creating a key, store the token in the session
+    # 2. On the success page, retrieve (and clear) the token
+    # 3. If the user refreshes, the token is gone
+    #
+    # @example In your controller
+    #   # After creating a key:
+    #   def create
+    #     @api_key = current_org.create_api_key!(...)
+    #     ApiKeys::Helpers::TokenSession.store(session, @api_key)
+    #     redirect_to success_path
+    #   end
+    #
+    #   # On the success page:
+    #   def success
+    #     @token = ApiKeys::Helpers::TokenSession.retrieve_once(session)
+    #     redirect_to index_path, alert: "Token already shown" unless @token
+    #   end
+    #
+    class TokenSession
+      # Default session key for storing the token
+      DEFAULT_SESSION_KEY = :api_keys_new_token
+
+      class << self
+        # Store an API key's token in the session for later retrieval.
+        #
+        # @param session [ActionDispatch::Request::Session] The Rails session
+        # @param api_key [ApiKeys::ApiKey] The newly created API key
+        # @param key [Symbol] Optional custom session key (default: :api_keys_new_token)
+        # @return [String] The token that was stored
+        def store(session, api_key, key: DEFAULT_SESSION_KEY)
+          token = api_key.respond_to?(:token) ? api_key.token : api_key.to_s
+          session[key] = token
+          token
+        end
+
+        # Retrieve and clear the token from the session.
+        # Returns nil if no token is stored (e.g., page was refreshed).
+        #
+        # @param session [ActionDispatch::Request::Session] The Rails session
+        # @param key [Symbol] Optional custom session key (default: :api_keys_new_token)
+        # @return [String, nil] The token, or nil if not present
+        def retrieve_once(session, key: DEFAULT_SESSION_KEY)
+          session.delete(key)
+        end
+
+        # Check if a token is available in the session without removing it.
+        # Useful for conditional rendering.
+        #
+        # @param session [ActionDispatch::Request::Session] The Rails session
+        # @param key [Symbol] Optional custom session key (default: :api_keys_new_token)
+        # @return [Boolean] true if a token is stored
+        def available?(session, key: DEFAULT_SESSION_KEY)
+          session[key].present?
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api_keys/helpers/view_helpers.rb b/lib/api_keys/helpers/view_helpers.rb
new file mode 100644
index 0000000..8ee0184
--- /dev/null
+++ b/lib/api_keys/helpers/view_helpers.rb
@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+module ApiKeys
+  module Helpers
+    # View helpers for displaying API key information.
+    #
+    # These helpers provide formatted data without HTML opinions,
+    # allowing integrators to build their own UI while using
+    # consistent data formatting.
+    #
+    # @example Include in your ApplicationHelper
+    #   module ApplicationHelper
+    #     include ApiKeys::Helpers::ViewHelpers
+    #   end
+    #
+    # @example Or include in a specific controller
+    #   class Settings::ApiKeysController < ApplicationController
+    #     helper ApiKeys::Helpers::ViewHelpers
+    #   end
+    #
+    module ViewHelpers
+      # Returns the status of an API key as a symbol.
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [Symbol] :active, :expired, or :revoked
+      #
+      # @example
+      #   api_key_status(@key) # => :active
+      #
+      def api_key_status(api_key)
+        return :revoked if api_key.revoked?
+        return :expired if api_key.expired?
+
+        :active
+      end
+
+      # Returns a human-readable status label for an API key.
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [String] "Active", "Expired", or "Revoked"
+      #
+      # @example
+      #   api_key_status_label(@key) # => "Active"
+      #
+      def api_key_status_label(api_key)
+        case api_key_status(api_key)
+        when :active then "Active"
+        when :expired then "Expired"
+        when :revoked then "Revoked"
+        end
+      end
+
+      # Returns the environment label for an API key.
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [String] "Test", "Live", or "Default" (if no environment set)
+      #
+      # @example
+      #   api_key_environment_label(@key) # => "Live"
+      #
+      def api_key_environment_label(api_key)
+        return "Default" if api_key.environment.blank?
+
+        api_key.environment.to_s.capitalize
+      end
+
+      # Returns the key type label for an API key.
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [String] "Publishable", "Secret", or the key_type capitalized
+      #
+      # @example
+      #   api_key_type_label(@key) # => "Secret"
+      #
+      def api_key_type_label(api_key)
+        return "Secret" if api_key.key_type.blank?
+
+        case api_key.key_type.to_s
+        when "publishable" then "Publishable"
+        when "secret" then "Secret"
+        else api_key.key_type.to_s.capitalize
+        end
+      end
+
+      # Returns whether the key is a publishable (public) key type.
+      # Useful for conditional rendering (e.g., showing/hiding copy button).
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [Boolean] true if the key is publishable
+      #
+      # @example
+      #   <% if api_key_publishable?(@key) %>
+      #     <%= button_tag "Copy", data: { token: @key.viewable_token } %>
+      #   <% end %>
+      #
+      def api_key_publishable?(api_key)
+        api_key.key_type.to_s == "publishable"
+      end
+
+      # Returns whether the key is a secret key type.
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [Boolean] true if the key is secret (or legacy with no type)
+      #
+      def api_key_secret?(api_key)
+        api_key.key_type.blank? || api_key.key_type.to_s == "secret"
+      end
+
+      # Detects the environment from a token string by parsing its prefix.
+      # Useful for displaying environment info when you only have the token.
+      #
+      # @param token [String] The full token string (e.g., "sk_test_abc123...")
+      # @return [Symbol, nil] The detected environment (:test, :live, etc.) or nil
+      #
+      # @example
+      #   api_key_environment_from_token("sk_test_abc123") # => :test
+      #   api_key_environment_from_token("pk_live_xyz789") # => :live
+      #   api_key_environment_from_token("ak_abc123")      # => nil
+      #
+      def api_key_environment_from_token(token)
+        return nil if token.blank?
+        return nil if token.length > 500 # Reasonable max length for tokens
+
+        config = ApiKeys.configuration
+        return nil unless config.environments.present?
+
+        # Check each configured environment's prefix segment
+        config.environments.each do |env_name, env_config|
+          segment = env_config[:prefix_segment]
+          next if segment.blank?
+
+          # Match pattern like _test_ or _live_ in the token
+          if token.include?("_#{segment}_")
+            return env_name
+          end
+        end
+
+        nil
+      end
+
+      # Returns a human-readable environment label from a token string.
+      # Convenience wrapper around api_key_environment_from_token.
+      #
+      # @param token [String] The full token string
+      # @return [String] "Test mode", "Live mode", or "Default" if unknown
+      #
+      # @example
+      #   api_key_environment_label_from_token("sk_test_abc") # => "Test mode"
+      #   api_key_environment_label_from_token("sk_live_xyz") # => "Live mode"
+      #
+      def api_key_environment_label_from_token(token)
+        env = api_key_environment_from_token(token)
+        return "Default" if env.nil?
+
+        "#{env.to_s.capitalize} mode"
+      end
+
+      # Returns a hash of status information for an API key.
+      # Useful for building custom status badges.
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [Hash] Hash with :status, :label, and :color keys
+      #
+      # @example
+      #   info = api_key_status_info(@key)
+      #   # => { status: :active, label: "Active", color: :green }
+      #
+      def api_key_status_info(api_key)
+        status = api_key_status(api_key)
+        {
+          status: status,
+          label: api_key_status_label(api_key),
+          color: status_color(status)
+        }
+      end
+
+      # Returns a hash of type information for an API key.
+      # Useful for building custom type badges.
+      #
+      # @param api_key [ApiKeys::ApiKey] The API key
+      # @return [Hash] Hash with :type, :label, and :color keys
+      #
+      # @example
+      #   info = api_key_type_info(@key)
+      #   # => { type: :publishable, label: "Publishable", color: :green }
+      #
+      def api_key_type_info(api_key)
+        type = api_key.key_type.presence&.to_sym || :secret
+        {
+          type: type,
+          label: api_key_type_label(api_key),
+          color: type_color(type)
+        }
+      end
+
+      private
+
+      def status_color(status)
+        case status
+        when :active then :green
+        when :expired then :red
+        when :revoked then :gray
+        else :gray
+        end
+      end
+
+      def type_color(type)
+        case type
+        when :publishable then :green
+        when :secret then :amber
+        else :gray
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api_keys/models/api_key.rb b/lib/api_keys/models/api_key.rb
index a40d36b..8301266 100644
--- a/lib/api_keys/models/api_key.rb
+++ b/lib/api_keys/models/api_key.rb
@@ -22,6 +22,18 @@ class ApiKey < ActiveRecord::Base
     # JSON attributes (:scopes, :metadata) are defined in the engine initializer
     # using ActiveSupport.on_load(:active_record) to ensure DB connection is ready.
 
+    # Override scopes setter to auto-clean blank values.
+    # This handles the common case where form checkboxes submit empty strings.
+    # Works for both create and update operations.
+    def scopes=(value)
+      cleaned = if value.is_a?(Array)
+                  value.reject { |s| s.blank? }
+                else
+                  value
+                end
+      super(cleaned)
+    end
+
     # == Validations ==
     validates :token_digest, presence: true, uniqueness: { case_sensitive: true }
     validates :prefix, presence: true
@@ -61,6 +73,12 @@ class ApiKey < ActiveRecord::Base
     scope :for_key_type, ->(key_type) { where(key_type: key_type.to_s) }
     scope :for_environment, ->(environment) { where(environment: environment.to_s) }
 
+    # Convenience scopes for key types
+    # .publishable returns only keys with key_type: "publishable"
+    # .secret returns keys that are NOT publishable (includes legacy keys with nil/blank key_type)
+    scope :publishable, -> { where(key_type: "publishable") }
+    scope :secret, -> { where.not(key_type: "publishable") }
+
     # == Instance Methods ==
 
     def revoke!
diff --git a/lib/api_keys/models/concerns/has_api_keys.rb b/lib/api_keys/models/concerns/has_api_keys.rb
index cb456b0..368398f 100644
--- a/lib/api_keys/models/concerns/has_api_keys.rb
+++ b/lib/api_keys/models/concerns/has_api_keys.rb
@@ -95,14 +95,70 @@ def default_scopes(value)
         # --- Instance Methods ---
         # Methods included in the owner model (e.g., User).
 
+        # Returns the available scopes for API keys on this owner.
+        # Uses owner-specific settings if defined, otherwise falls back to global config.
+        # Useful for populating scope checkboxes in forms.
+        #
+        # @return [Array<String>] The available scopes
+        def available_api_key_scopes
+          owner_settings = self.class.api_keys_settings
+          owner_settings&.[](:default_scopes) || ApiKeys.configuration.default_scopes || []
+        end
+
+        # Checks if this owner can create an API key of the given type.
+        # Returns false if the limit for this key type/environment is reached.
+        # Useful for conditional UI (e.g., hiding "Create" button when at limit).
+        #
+        # Note: This is a best-effort check for UI purposes without locking.
+        # Concurrent requests could see stale data. The actual limit is enforced
+        # with pessimistic locking in create_api_key!, so this is safe to use
+        # for UI decisions (worst case: button shown but creation fails validation).
+        #
+        # @param key_type [Symbol, nil] The key type to check (e.g., :publishable, :secret)
+        # @param environment [Symbol, nil] The environment to check (defaults to current_environment)
+        # @return [Boolean] true if the owner can create another key of this type
+        #
+        # @example
+        #   if current_org.can_create_api_key?(key_type: :publishable)
+        #     # Show "Create Publishable Key" button
+        #   end
+        #
+        def can_create_api_key?(key_type: nil, environment: nil)
+          config = ApiKeys.configuration
+
+          # If no key_type specified, check global quota only
+          return within_global_quota? if key_type.nil?
+
+          # Resolve environment
+          resolved_environment = resolve_environment(environment, key_type, config)
+
+          # Get type-specific limit
+          type_config = config.key_types&.dig(key_type.to_sym)
+          return within_global_quota? unless type_config
+
+          limit = type_config[:limit]
+          return within_global_quota? unless limit
+
+          # Count existing keys of this type/environment
+          existing_count = api_keys
+                            .active
+                            .where(key_type: key_type.to_s)
+                            .where(environment: resolved_environment.to_s)
+                            .count
+
+          existing_count < limit && within_global_quota?
+        end
+
         # Creates a new API key for this owner instance and returns the ApiKey instance.
         # Raises ActiveRecord::RecordInvalid if creation fails.
         #
         # @param name [String] The name for the new API key (required).
         # @param scopes [Array<String>, nil] Scopes for the key. Defaults to owner/global settings.
         #   When key_type is specified, scopes are filtered to only include those allowed
-        #   by the key type's permissions ceiling.
+        #   by the key type's permissions ceiling. Blank values are automatically removed.
         # @param expires_at [Time, nil] Optional expiration timestamp.
+        # @param expires_at_preset [String, nil] Convenience param: "7_days", "30_days", "no_expiration", etc.
+        #   If provided, this is parsed into expires_at. Takes precedence over expires_at if both given.
         # @param metadata [Hash, nil] Optional metadata hash.
         # @param key_type [Symbol, nil] The key type (e.g., :publishable, :secret).
         #   Must be defined in ApiKeys.configuration.key_types if provided.
@@ -111,9 +167,19 @@ def default_scopes(value)
         # @return [ApiKeys::ApiKey] The newly created ApiKey instance. The plaintext token
         #                           is available via the `#token` attribute on this instance
         #                           *only until it's reloaded*.
-        def create_api_key!(name: nil, scopes: nil, expires_at: nil, metadata: nil, key_type: nil, environment: nil)
+        def create_api_key!(name: nil, scopes: nil, expires_at: nil, expires_at_preset: nil, metadata: nil, key_type: nil, environment: nil)
           config = ApiKeys.configuration
 
+          # Parse expires_at_preset if provided (takes precedence over expires_at)
+          if expires_at_preset.present?
+            expires_at = ApiKeys::Helpers::ExpirationOptions.parse(expires_at_preset)
+          end
+
+          # Auto-clean scopes: remove blank values from arrays (common when using form checkboxes)
+          if scopes.is_a?(Array)
+            scopes = scopes.reject { |s| s.blank? }
+          end
+
           # Check for missing columns if key_types feature is enabled
           if key_types_feature_enabled?(config)
             check_required_columns!
@@ -168,6 +234,14 @@ def create_api_key!(name: nil, scopes: nil, expires_at: nil, metadata: nil, key_
 
         private
 
+        def within_global_quota?
+          owner_settings = self.class.api_keys_settings
+          limit = owner_settings&.[](:max_keys) || ApiKeys.configuration.default_max_keys_per_owner
+          return true unless limit
+
+          api_keys.active.count < limit
+        end
+
         def key_types_feature_enabled?(config)
           config.key_types.present? && config.key_types.any?
         end
diff --git a/test/helpers/expiration_options_test.rb b/test/helpers/expiration_options_test.rb
new file mode 100644
index 0000000..7dc3695
--- /dev/null
+++ b/test/helpers/expiration_options_test.rb
@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module ApiKeys
+  module Helpers
+    class ExpirationOptionsTest < ApiKeys::Test
+      test "for_select returns default options" do
+        options = ExpirationOptions.for_select
+
+        assert_equal 6, options.length
+        assert_equal ["No Expiration", "no_expiration"], options.first
+        assert_equal ["7 days", "7_days"], options[1]
+        assert_equal ["1 year", "365_days"], options.last
+      end
+
+      test "for_select without no_expiration option" do
+        options = ExpirationOptions.for_select(include_no_expiration: false)
+
+        assert_equal 5, options.length
+        refute options.any? { |label, _| label == "No Expiration" }
+        assert_equal ["7 days", "7_days"], options.first
+      end
+
+      test "for_select with custom presets" do
+        options = ExpirationOptions.for_select(presets: [7, 30, 365])
+
+        assert_equal 4, options.length # includes "No Expiration"
+        assert_equal ["No Expiration", "no_expiration"], options.first
+        assert_equal ["7 days", "7_days"], options[1]
+        assert_equal ["30 days", "30_days"], options[2]
+        assert_equal ["1 year", "365_days"], options[3]
+      end
+
+      test "for_select with custom presets without no_expiration" do
+        options = ExpirationOptions.for_select(presets: [7, 30], include_no_expiration: false)
+
+        assert_equal 2, options.length
+        assert_equal ["7 days", "7_days"], options.first
+        assert_equal ["30 days", "30_days"], options.last
+      end
+
+      test "for_select generates correct label for 1 day" do
+        options = ExpirationOptions.for_select(presets: [1])
+
+        assert_equal ["1 day", "1_days"], options[1]
+      end
+
+      test "for_select generates correct label for multiple years" do
+        options = ExpirationOptions.for_select(presets: [730])
+
+        assert_equal ["2 years", "730_days"], options[1]
+      end
+
+      test "parse returns nil for no_expiration" do
+        result = ExpirationOptions.parse("no_expiration")
+
+        assert_nil result
+      end
+
+      test "parse returns nil for blank value" do
+        assert_nil ExpirationOptions.parse(nil)
+        assert_nil ExpirationOptions.parse("")
+      end
+
+      test "parse returns correct date for days preset" do
+        freeze_time do
+          result = ExpirationOptions.parse("30_days")
+
+          assert_in_delta 30.days.from_now.to_i, result.to_i, 1
+        end
+      end
+
+      test "parse handles singular day preset" do
+        freeze_time do
+          result = ExpirationOptions.parse("1_day")
+
+          assert_in_delta 1.day.from_now.to_i, result.to_i, 1
+        end
+      end
+
+      test "parse returns nil for invalid preset" do
+        assert_nil ExpirationOptions.parse("invalid")
+        assert_nil ExpirationOptions.parse("abc_days")
+        assert_nil ExpirationOptions.parse("0_days")
+      end
+
+      test "parse returns nil for excessively large days value" do
+        assert_nil ExpirationOptions.parse("99999999999_days")
+        assert_nil ExpirationOptions.parse("3651_days") # Just over 10 years
+      end
+
+      test "parse accepts maximum allowed days" do
+        freeze_time do
+          result = ExpirationOptions.parse("3650_days")
+
+          assert_in_delta 3650.days.from_now.to_i, result.to_i, 1
+        end
+      end
+
+      test "parse boundary conditions for max days" do
+        freeze_time do
+          # 3650 days (exactly 10 years) should work
+          assert_not_nil ExpirationOptions.parse("3650_days")
+
+          # 3651 days (just over 10 years) should not work
+          assert_nil ExpirationOptions.parse("3651_days")
+
+          # Large but valid values
+          result = ExpirationOptions.parse("1000_days")
+          assert_in_delta 1000.days.from_now.to_i, result.to_i, 1
+        end
+      end
+
+      test "parse handles negative and zero days" do
+        assert_nil ExpirationOptions.parse("0_days")
+        assert_nil ExpirationOptions.parse("-1_days")
+        assert_nil ExpirationOptions.parse("-365_days")
+      end
+
+      test "parse works with known presets" do
+        freeze_time do
+          result = ExpirationOptions.parse("365_days")
+
+          assert_in_delta 365.days.from_now.to_i, result.to_i, 1
+        end
+      end
+
+      test "default_value returns no_expiration" do
+        assert_equal "no_expiration", ExpirationOptions.default_value
+      end
+    end
+  end
+end
diff --git a/test/helpers/token_session_test.rb b/test/helpers/token_session_test.rb
new file mode 100644
index 0000000..64c74f7
--- /dev/null
+++ b/test/helpers/token_session_test.rb
@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module ApiKeys
+  module Helpers
+    class TokenSessionTest < ApiKeys::Test
+      def setup
+        @session = {}
+      end
+
+      test "stores token from api_key object with token method" do
+        api_key = mock("api_key")
+        api_key.stubs(:respond_to?).with(:token).returns(true)
+        api_key.stubs(:token).returns("sk_test_abc123")
+
+        result = TokenSession.store(@session, api_key)
+
+        assert_equal "sk_test_abc123", result
+        assert_equal "sk_test_abc123", @session[:api_keys_new_token]
+      end
+
+      test "stores token from object without token method using to_s" do
+        result = TokenSession.store(@session, "plain_token_string")
+
+        assert_equal "plain_token_string", result
+        assert_equal "plain_token_string", @session[:api_keys_new_token]
+      end
+
+      test "stores token with custom session key" do
+        api_key = mock("api_key")
+        api_key.stubs(:respond_to?).with(:token).returns(true)
+        api_key.stubs(:token).returns("custom_token")
+
+        TokenSession.store(@session, api_key, key: :my_custom_key)
+
+        assert_equal "custom_token", @session[:my_custom_key]
+        assert_nil @session[:api_keys_new_token]
+      end
+
+      test "retrieve_once returns and clears token" do
+        @session[:api_keys_new_token] = "stored_token"
+
+        result = TokenSession.retrieve_once(@session)
+
+        assert_equal "stored_token", result
+        assert_nil @session[:api_keys_new_token]
+      end
+
+      test "retrieve_once returns nil when no token stored" do
+        result = TokenSession.retrieve_once(@session)
+
+        assert_nil result
+      end
+
+      test "retrieve_once with custom key" do
+        @session[:my_key] = "my_token"
+
+        result = TokenSession.retrieve_once(@session, key: :my_key)
+
+        assert_equal "my_token", result
+        assert_nil @session[:my_key]
+      end
+
+      test "available? returns true when token present" do
+        @session[:api_keys_new_token] = "some_token"
+
+        assert TokenSession.available?(@session)
+      end
+
+      test "available? returns false when token not present" do
+        refute TokenSession.available?(@session)
+      end
+
+      test "available? returns false when token is blank" do
+        @session[:api_keys_new_token] = ""
+
+        refute TokenSession.available?(@session)
+      end
+
+      test "available? with custom key" do
+        @session[:custom] = "token"
+
+        assert TokenSession.available?(@session, key: :custom)
+        refute TokenSession.available?(@session, key: :other)
+      end
+    end
+  end
+end
diff --git a/test/helpers/view_helpers_test.rb b/test/helpers/view_helpers_test.rb
new file mode 100644
index 0000000..e333555
--- /dev/null
+++ b/test/helpers/view_helpers_test.rb
@@ -0,0 +1,254 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module ApiKeys
+  module Helpers
+    class ViewHelpersTest < ApiKeys::Test
+      include ViewHelpers
+
+      def setup
+        super
+        @active_key = mock("active_key")
+        @active_key.stubs(:revoked?).returns(false)
+        @active_key.stubs(:expired?).returns(false)
+        @active_key.stubs(:key_type).returns("secret")
+        @active_key.stubs(:environment).returns("test")
+
+        @revoked_key = mock("revoked_key")
+        @revoked_key.stubs(:revoked?).returns(true)
+        @revoked_key.stubs(:expired?).returns(false)
+        @revoked_key.stubs(:key_type).returns("secret")
+        @revoked_key.stubs(:environment).returns("live")
+
+        @expired_key = mock("expired_key")
+        @expired_key.stubs(:revoked?).returns(false)
+        @expired_key.stubs(:expired?).returns(true)
+        @expired_key.stubs(:key_type).returns("publishable")
+        @expired_key.stubs(:environment).returns(nil)
+
+        @publishable_key = mock("publishable_key")
+        @publishable_key.stubs(:revoked?).returns(false)
+        @publishable_key.stubs(:expired?).returns(false)
+        @publishable_key.stubs(:key_type).returns("publishable")
+        @publishable_key.stubs(:environment).returns("test")
+      end
+
+      # api_key_status tests
+      test "api_key_status returns :active for active key" do
+        assert_equal :active, api_key_status(@active_key)
+      end
+
+      test "api_key_status returns :revoked for revoked key" do
+        assert_equal :revoked, api_key_status(@revoked_key)
+      end
+
+      test "api_key_status returns :expired for expired key" do
+        assert_equal :expired, api_key_status(@expired_key)
+      end
+
+      test "api_key_status returns :revoked over :expired when both" do
+        key = mock("key")
+        key.stubs(:revoked?).returns(true)
+        key.stubs(:expired?).returns(true)
+
+        assert_equal :revoked, api_key_status(key)
+      end
+
+      # api_key_status_label tests
+      test "api_key_status_label returns Active for active key" do
+        assert_equal "Active", api_key_status_label(@active_key)
+      end
+
+      test "api_key_status_label returns Revoked for revoked key" do
+        assert_equal "Revoked", api_key_status_label(@revoked_key)
+      end
+
+      test "api_key_status_label returns Expired for expired key" do
+        assert_equal "Expired", api_key_status_label(@expired_key)
+      end
+
+      # api_key_environment_label tests
+      test "api_key_environment_label returns capitalized environment" do
+        assert_equal "Test", api_key_environment_label(@active_key)
+        assert_equal "Live", api_key_environment_label(@revoked_key)
+      end
+
+      test "api_key_environment_label returns Default for blank environment" do
+        assert_equal "Default", api_key_environment_label(@expired_key)
+      end
+
+      # api_key_type_label tests
+      test "api_key_type_label returns Secret for secret key" do
+        assert_equal "Secret", api_key_type_label(@active_key)
+      end
+
+      test "api_key_type_label returns Publishable for publishable key" do
+        assert_equal "Publishable", api_key_type_label(@publishable_key)
+      end
+
+      test "api_key_type_label returns Secret for blank key_type" do
+        key = mock("key")
+        key.stubs(:key_type).returns(nil)
+
+        assert_equal "Secret", api_key_type_label(key)
+      end
+
+      test "api_key_type_label returns capitalized custom type" do
+        key = mock("key")
+        key.stubs(:key_type).returns("custom")
+
+        assert_equal "Custom", api_key_type_label(key)
+      end
+
+      # api_key_publishable? tests
+      test "api_key_publishable? returns true for publishable key" do
+        assert api_key_publishable?(@publishable_key)
+      end
+
+      test "api_key_publishable? returns false for secret key" do
+        refute api_key_publishable?(@active_key)
+      end
+
+      # api_key_secret? tests
+      test "api_key_secret? returns true for secret key" do
+        assert api_key_secret?(@active_key)
+      end
+
+      test "api_key_secret? returns true for nil key_type" do
+        key = mock("key")
+        key.stubs(:key_type).returns(nil)
+
+        assert api_key_secret?(key)
+      end
+
+      test "api_key_secret? returns false for publishable key" do
+        refute api_key_secret?(@publishable_key)
+      end
+
+      # api_key_environment_from_token tests
+      test "api_key_environment_from_token detects test environment" do
+        with_environments do
+          assert_equal :test, api_key_environment_from_token("sk_test_abc123")
+          assert_equal :test, api_key_environment_from_token("pk_test_xyz789")
+        end
+      end
+
+      test "api_key_environment_from_token detects live environment" do
+        with_environments do
+          assert_equal :live, api_key_environment_from_token("sk_live_abc123")
+          assert_equal :live, api_key_environment_from_token("pk_live_xyz789")
+        end
+      end
+
+      test "api_key_environment_from_token returns nil for unknown pattern" do
+        with_environments do
+          assert_nil api_key_environment_from_token("ak_abc123")
+          assert_nil api_key_environment_from_token("random_token")
+        end
+      end
+
+      test "api_key_environment_from_token returns nil for blank token" do
+        assert_nil api_key_environment_from_token(nil)
+        assert_nil api_key_environment_from_token("")
+      end
+
+      test "api_key_environment_from_token returns nil when no environments configured" do
+        ApiKeys.configuration.stubs(:environments).returns({})
+
+        assert_nil api_key_environment_from_token("sk_test_abc123")
+      end
+
+      test "api_key_environment_from_token returns nil for excessively long token" do
+        long_token = "sk_test_" + ("a" * 1000)
+
+        assert_nil api_key_environment_from_token(long_token)
+      end
+
+      test "api_key_environment_from_token accepts token at max length boundary" do
+        with_environments do
+          # 500 chars exactly should work
+          token_at_limit = "sk_test_" + ("a" * 492) # 8 + 492 = 500
+          assert_equal :test, api_key_environment_from_token(token_at_limit)
+
+          # 501 chars should fail
+          token_over_limit = "sk_test_" + ("a" * 493) # 8 + 493 = 501
+          assert_nil api_key_environment_from_token(token_over_limit)
+        end
+      end
+
+      # api_key_environment_label_from_token tests
+      test "api_key_environment_label_from_token returns formatted label" do
+        with_environments do
+          assert_equal "Test mode", api_key_environment_label_from_token("sk_test_abc")
+          assert_equal "Live mode", api_key_environment_label_from_token("pk_live_xyz")
+        end
+      end
+
+      test "api_key_environment_label_from_token returns Default for unknown" do
+        with_environments do
+          assert_equal "Default", api_key_environment_label_from_token("ak_abc123")
+        end
+      end
+
+      # api_key_status_info tests
+      test "api_key_status_info returns hash with status details" do
+        info = api_key_status_info(@active_key)
+
+        assert_equal :active, info[:status]
+        assert_equal "Active", info[:label]
+        assert_equal :green, info[:color]
+      end
+
+      test "api_key_status_info returns correct color for revoked" do
+        info = api_key_status_info(@revoked_key)
+
+        assert_equal :gray, info[:color]
+      end
+
+      test "api_key_status_info returns correct color for expired" do
+        info = api_key_status_info(@expired_key)
+
+        assert_equal :red, info[:color]
+      end
+
+      # api_key_type_info tests
+      test "api_key_type_info returns hash with type details" do
+        info = api_key_type_info(@publishable_key)
+
+        assert_equal :publishable, info[:type]
+        assert_equal "Publishable", info[:label]
+        assert_equal :green, info[:color]
+      end
+
+      test "api_key_type_info returns amber for secret" do
+        info = api_key_type_info(@active_key)
+
+        assert_equal :secret, info[:type]
+        assert_equal :amber, info[:color]
+      end
+
+      test "api_key_type_info treats nil key_type as secret" do
+        key = mock("key")
+        key.stubs(:key_type).returns(nil)
+
+        info = api_key_type_info(key)
+
+        assert_equal :secret, info[:type]
+      end
+
+      private
+
+      def with_environments
+        original = ApiKeys.configuration.environments
+        ApiKeys.configuration.stubs(:environments).returns({
+          test: { prefix_segment: "test" },
+          live: { prefix_segment: "live" }
+        })
+        yield
+      ensure
+        ApiKeys.configuration.unstub(:environments)
+      end
+    end
+  end
+end