Authentication
Service keys gate POST explorers and MCP invokes. Paste once — it persists in your browser (`localStorage` key toolbox_console_service_key).
Toolbox write routes (every POST/PUT/PATCH/DELETE spoke route + MCP `/api/mcp`) expect the production TOOLBOX_SERVICE_KEY. Paste the same credential you deploy to integrations — it never leaves this browser unless you deliberately fire a network request via the explorers.
Status
No key cached
Follow the onboarding runbook in docs/EXTERNAL-CONSUMERS.md for provisioning keys, headers, and audit verification.