Every paid enrichment endpoint requires a revocable API key sent as a Bearer token. Signup is email-verified and never returns a key inline.
Send your API key on every authenticated request:
Authorization: Bearer <api_key>
POST /api/signup with {email, client_name, device_name} → 202 transactionGET /api/signup/verification/:transaction_id with X-Verification-Tokenstatus: approved, claim once via POST .../claim
Compromised key: POST /api/account/rotate-key. Lost key: sign in at
/account and rotate all account keys.