API authentication
How production API keys will authenticate requests.
The service core already enforces scoped bearer keys. Customer creation, reveal-once handling, rotation and revocation are not connected to the website yet.
Current status
This guide documents the first customer-control-plane tranche. It does not imply that paid production, billing, public endpoints or unfinished controls are live.