Authentication

Send the secret test key on every call except GET /v1.

Authorization: Bearer lp_test_...

The full test key is shown once, in the dashboard, when an operator approves the application. After that the dashboard shows the prefix only. Keys are stored as a hash.

A disabled live key answers 403 with code live_mode_unavailable.