API keys

Bearer tokens for non-browser callers (webhook senders, partner systems, scripted clients). Use them via Authorization: Bearer sw_…. They inherit your role set; revoke them the moment they leak.