API keys grant programmatic access with the selected role's permissions. The full key is only shown once at creation time — store it securely. Use Authorization: Bearer tak_... header for API requests.