Authentication

Authenticate with a hashed API key or a signed session cookie.

Send a secret key as a Bearer token. Keys are stored as SHA-256 hashes. The last-used time is recorded on each successful call.

The studio session cookie is accepted for interactive use. Never put a live key in client-side JavaScript you ship to the public web.

Revoke a key from the console. The secret is shown once at creation.