Core concept
Authentication
Use a scoped Bearer token in every server-side request. Never expose live keys in browser code or public repositories.
Authorization: Bearer drm_live_...
Production rule: rotate compromised keys immediately from the developer dashboard.