API key management requires a verified Heartwood session.