Every endpoint on this page is admin-gated. Stored only in this browser's local storage and sent as the x-api-key header. The webhook URLs themselves never use it — they authenticate with the per-flow secret below.