apps/api/src/api/routes/v1/.X-API-Key: sk_<live|test>_... — partner SDK key (server-side).X-Public-Key: pk_<live|test>_... — partner public key (browser; attribution only).Authorization: Bearer <Supabase JWT> — first-party user session./v1/brla/* endpoints accept Supabase Bearer only; partner sk_/pk_ keys are not accepted on BRLA routes.GET /v1/public-key.