API clients and keys

Administrators issue named keys. Copy each key once into a secret manager. API help OpenAPI

Explicit scopes