2. Authentication
| Surface | Mechanism |
|---|---|
| HTTP endpoints | Authorization: Bearer zk_xxxxxxxxxxxxxxxx |
| WebSocket | URL query: ?key=zk_xxxxxxxxxxxxxxxx (browser WS API can't set headers) |
API keys are workspace-scoped (max 3 per workspace, max 10 workspaces per
developer = 30 keys / developer). Keys mint via /developer/keys UI in
Phase 3.