Make a service account. Its client secret is in this response only.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. It acts in the workspace you choose (the organization's main workspace by default) with the admin role there, limited by its scopes, and spends up to its daily and per-question caps. Up to 50 (409 too_many_service_accounts). With authMethod: private_key_jwt, send your public keys in jwks and no secret is made. Behind the machineIdentities sub-flag: 404 not_found while it is off. A service account gets tokens from https://auth.50heads.com/token with grant_type=client_credentials and its client id and secret (HTTP Basic or the body) or a private_key_jwt assertion; no refresh token, ask again when it expires.