API keys

• A key acts with exactly its owner's permissions, never more.
• Keys are shown once, expire after 90 days by default, and can be revoked at once.
• A read-only key is enforced by the database: its transactions cannot write.
• Each key is rate-limited, so a runaway script slows down instead of degrading the service for others.