Authentication: personal access token. The spec defines an api_key security scheme — send an Authorization: ApiKey <your-personal-access-token> header (value format: ApiKey <your key>). A session_cookie scheme (connect.sid) exists for browser sessions. Operations in this spec declare security: [], an artifact of the upstream spec generator — authentication is still enforced by the server.