Org). Calls authenticated with a key always run against that workspace, never against
whichever org the key creator last clicked into in the UI. Unlike OAuth client secrets, the
API key stays visible in Settings so you can copy it again later — regenerate it if it leaks.
Permissions
A key inherits the permissions of the workspace role it was created under:
Both built-in roles can read and submit.
manage_documents is on the Admin role only.
The flag catalogue (GET /api/v1/document-checks/flags/) is a static reference table and needs
no document permission, only a valid key.