PublishableOnly

Authenticate with the publishable key (pk_) unconditionally, never overridden by an active onboarding session. Merchant-level endpoints (sonar, configuration, wallet config) use this — they are not account-scoped and the backend rejects an onb_sess_ token on them ("Client secret is not permitted for this endpoint.").