Create and revoke keys in the Contour dashboard under Settings → Developers.
A key is shown once when created.
Keep the key server-side. Anyone holding it can place calls and read call
results as your organization.
Errors
A missing or invalid key returns 401 with a plain-string detail:
Rate limit
300 requests per minute per IP. Requests over the limit return 429.
Webhooks are different
Requests we send to you do not carry your API key. They are authenticated
by an HMAC signature in the X-Contour-Signature header instead. See
Verifying signatures. 
