API authentication

Every request needs a bearer token in the Authorization header. Keys are prefixed vd_live_ or vd_test_. Test keys return deterministic fixtures and never consume credits, so your CI can run against them.

Authorization: Bearer vd_live_••••••••••••

Each key has its own usage, rate limit, and optional spend cap. Never ship a live key to a browser; use a test key or proxy through your server.