Store and use API keys safely

Use an API key as a bearer credential for the supported management routes.

Store the key in a secret manager or another protected runtime secret store.

Do not put it in source code, browser-visible configuration, issue text, screenshots, or ordinary logs.

Rotate safely by creating and deploying a replacement first, confirming it works, and then revoking the old key.

This API-key contract does not define scopes or a general public endpoint catalog.