Commits for one project

Create one in the app under Settings → API keys. It is shown once and stored only as a hash, so it cannot be recovered — losing it means issuing a new one.

A key reads the endpoints below and nothing else. It is not a session: it cannot create or delete projects, change settings, or issue another API key. It sees exactly what its owner sees, re-checked on every request, so removing someone’s access to a project removes it from their key on the very next call.

The same key, sent as Authorization: Bearer <key>.