X-API-Key header.
Expiration
An API key can carry an optional expiry date. Expired keys return401 UNAUTHORIZED.
Optional authentication
GET /design/submissions/{id}/result and GET /design/submissions/{id}/download are authenticated endpoints. They accept unauthenticated requests as a narrow carve-out for extractions that have been explicitly made public: a request without a key sees those and nothing else.

