Every endpoint requires Authorization: Bearer <api-key>. Bearer is the only supported scheme — there is no x-api-key-style header.
Keys come in two forms, otherwise functionally identical — same base URL, same schemas, same real-or-mock provider dispatch per category:
gr_live_…— real key, billed against the account's real shard balance.
gr_test_… — sandbox key, for pre-launch integration testing. Minted the same way as a live key, via /dashboard/keys, selecting the "Test" environment. There is no separate test API surface to point at.
A Portal AIR session token is also accepted on these endpoints, but that's the Nexus dashboard's own auth path — not relevant to external integrations.