Internal only
This gate is backed by the existing INTERNAL_API_KEY, but the key itself stays on the server once validated.