Publishable

Authenticate with the publishable key (pk_), unless an onboarding session is active — the session token then takes precedence. Account-scoped client-safe reads use this: mid-session they need the session token for the server to return PII-gated fields such as profile.