Adding API Key Auth (Scalekit)

Guardrails

MUST read SCALEKIT_ENVIRONMENT_URL / SCALEKIT_CLIENT_ID / SCALEKIT_CLIENT_SECRET from env vars when initializing the client; MUST NOT hardcode them.
MUST validate the opaque token or JWT server-side on every incoming API request; MUST NOT trust an unverified token.
MUST treat the plain-text token / plain_secret as returned only once at creation and store it securely (never logged or committed); use token_id (not the key itself) for list/invalidate lifecycle operations.

1. Mechanism (do not mix code from both sections in one flow):

Path	When to use	Sections
A. Opaque API keys	Long-lived keys for partners, CI, personal access tokens; validate via Scalekit token API	§§1–6 + Key rules
B. OAuth 2.0 client credentials	Short-lived JWTs, scope-based M2M, JWKS validation	Client Credentials section only

If the user is unclear, ask once: opaque API keys vs client-credentials JWTs.