A customer's systems push records to POST https://sunpilot.work/api/projects with an API key as Authorization: Bearer sk_live_…. Each key is scoped to one customer, so every record it writes is tagged to that customer. Keys are shown once at creation — if lost, issue a new one and revoke the old.