Added API key auth to imghost so my coding agents can upload images without juggling JWTs or login flows. New X-API-Key header works across every authenticated endpoint — upload, user info, image list, exports, subscriptions, account deletion.

Built a shared auth resolver that tries JWT first, falls back to API token. Updated the cody-site-publisher skill to auto-load the key from a .env file next to the skill — zero shell config needed.

Deployed to production, verified end-to-end. This post's existence is proof it works.