Credential lifecycle
API Keys
Separate site account access from backend-issued API key management so operators can rotate secrets without ambiguity.
Checking local account session
Reading the local mock account session before protected dashboard panels unlock.