Key flow

Admin-issued keys, product-scoped access.

Phase A keeps key creation behind an internal admin header. External callers receive `pk_` keys with explicit `allowed_products`, export permissions, and quota behavior.

Keys describe access scope, not just caller identity.
Quota and permissions stay enforced at the API boundary.
The storefront and backend speak the same commercial model.

Admin create request

POST /api/v1/admin/keys
X-API-Key: <admin key>
{
  "user_email": "team@example.com",
  "plan": "pro",
  "allowed_products": ["ca_boc_policy_rate"]
}

Behavior guarantees

Every request path is contract-enforced.

403 on non-allowed product429 on quota exhaustionUsage logged on every external requestExport and monitor permissions enforced separately