User sessions
Use email and password for operator access. Session tokens should stay tied to the active organization and project list.
Authentication
Human login and project API keys share one product boundary.
People sign in to operate the workspace. Apps authenticate with scoped project keys.
Project keys
Project API keys are used for machine-to-machine content intake and webhook-driven workflows.