API keys

Authenticate every request with Authorization: Bearer <key>. Treat keys like passwords - never commit them to a repository.