Portal -> API tokens -> create -> copy dklt.<id>.<secret> once. Use as Authorization: Bearer ... for CLI and automation. Rotate if leaked.