Browser access uses GitHub OAuth. Local API access can use HMAC headers with LOCAL_API_HMAC_SECRET.