API keys

Agents should use the API key returned by device auth, then call /v1/me to understand account state and next steps.

Do not embed keys in client-side code, shared docs, or repositories. Rotate exposed keys and re-authenticate.