Use a Bearer token.
Agency and Enterprise accounts can generate a token from the dashboard. Treat it like a password.
Authorization: Bearer YOUR_API_TOKEN
X-Api-Token: YOUR_API_TOKEN is also accepted for same-origin tools and password-protected staging. Legacy ?token=YOUR_API_TOKEN still works, but headers are preferred because they avoid exposing credentials in URLs and logs.