Scoped keys
Workspace owners create keys limited to leads:read, leads:write or campaigns:read, and can revoke them at any time.
Same rules as the app
Leads created through the API go through the same lawful-basis, deduplication and suppression checks as a CSV import.

