API keys
Use app keys and scoped management keys.
Cloud API keys
oac_sk_ keys belong to one app and authenticate ingestion, security checks, email, and SMS from the Own Auth package.
Management keys
oac_mk_ keys call management APIs. They can be account-wide or limited to one owned app, use explicit scopes, may expire, and are shown only once. App webhook configuration uses the dedicated apps:read and apps:write scopes.