diff --git a/docs/mobile-api-keys.md b/docs/mobile-api-keys.md
index e089d52e..0fc58dc2 100644
--- a/docs/mobile-api-keys.md
+++ b/docs/mobile-api-keys.md
@@ -79,11 +79,11 @@ answer.
 
 Identical to the JWT in all three places:
 
-| Where | How |
-|---|---|
-| Normal requests | `Authorization: Bearer ofk_…` |
-| Media URLs (`<Image>`, `<Video>`, file `/raw`) | `?token=ofk_…` — URL-encode it |
-| WebSockets | `?token=ofk_…` on the upgrade URL |
+| Where                                          | How                               |
+| ---------------------------------------------- | --------------------------------- |
+| Normal requests                                | `Authorization: Bearer ofk_…`     |
+| Media URLs (`<Image>`, `<Video>`, file `/raw`) | `?token=ofk_…` — URL-encode it    |
+| WebSockets                                     | `?token=ofk_…` on the upgrade URL |
 
 The `?token=` fallback is accepted on **every** protected `/api` route, not just media. That is
 pre-existing behaviour and not something to rely on: it puts the credential in URLs, which reach proxy
@@ -125,9 +125,9 @@ will not meet it.
 
 **401 and 403 mean different things and must be handled differently.**
 
-| Status | Meaning | What the app should do |
-|---|---|---|
-| **401** | The credential is dead — revoked, expired, or never valid. | Clear it, send the user to the login screen. |
+| Status  | Meaning                                                              | What the app should do                                                                     |
+| ------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
+| **401** | The credential is dead — revoked, expired, or never valid.           | Clear it, send the user to the login screen.                                               |
 | **403** | The credential is **fine**; this account may not reach this feature. | **Do not clear the credential.** Show "not available for your account" and stay signed in. |
 
 Clearing a good key on a 403 is the failure mode to avoid: it turns a member's missing capability into a
@@ -185,7 +185,11 @@ id; there is no request shape that reaches another account's keys.
 ### `GET /api/api-keys`
 
 ```jsonc
-{ "keys": [ /* entry objects as above, newest first — never the key itself */ ] }
+{
+  "keys": [
+    /* entry objects as above, newest first — never the key itself */
+  ],
+}
 ```
 
 `lastUsedAt` is debounced to at most one write a minute, so it can lag by up to 60 seconds. It is a