Per-tenant Bearer keys for /api/v1/* clients. Issued, hashed (argon2id), and rotated server-side — the cleartext key is shown to you exactly once at creation.
Issue your first key to give an external client access to /api/v1/*.