API keys

Keys authenticate non-browser clients with the X-API-Key header. Scopes are least-privilege; the full key is shown only once.