API keys

Keys authenticate REST and server-side MCP calls with an Authorization: Bearer header. Each key is shown once at creation and can be revoked at any time.