Use the Authorize button with a workspace or environment API key. Scope and RBAC are enforced server-side.