Authentication
Session tokens
Separate web console sessions from API keys.
The web console should authenticate users with short-lived HttpOnly session cookies. API keys are
for programmatic access and should not be stored in local storage.
Session-backed UI flows can still create API keys, inspect usage, review receipts, and manage
payments through the same account controls.