Send your key as a bearer token on every request:
  • Keys are issued and revoked by Mergen admins. Call the API from your backend only.
  • vg_test_ keys place real calls; they are not a sandbox.
  • Ids of another account answer 404 not_found.
Browsers use short-lived web session tokens instead: see Web calling.