Authenticated developer APIs only — public catalog does not mean anonymous or unrestricted access. Sandbox credentials never reach production.