Send your API key on every request:

Authorization: Bearer alara_...

If the key is missing/invalid, you’ll receive ALARA_AUTH_INVALID_KEY.

Keys are owned by an organization. Create and revoke keys in the portal.