Test API Key:test_pk_sandbox_12345
Auth Isolation:pk_live_* keys rejected, test_pk_* required
Rate Limit:100 req/min (real enforcement via CacheEntry)
Idempotency:24h TTL, issue + redeem actions
Webhook Signing:HMAC-SHA256 with X-Webhook-Signature header
Valid Denominations:100, 250, 500, 1000, 2500, 5000 HTG