Update user
Changing your own password or email requires current_password, because
that operation converts possession of a credential into lasting control
of the account. A non-user credential may not do it at all: an API key
carries its owner’s user_id, so without this rule a scoped machine
credential could set the owner’s password and become an interactive
login.
A caller holding user:manage may still reset somebody else’s
credentials, which is what that permission is for.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.