Concepts
Owner-only and app-only
A few endpoints act on the workspace itself or on money. Some need the workspace owner, and some only work from the app, never with an API key.
Owner only
Some endpoints are for the workspace owner alone: deleting the workspace, handing it to another member, limiting a member to some brands, paying for a plan, changing the plan, opening the billing portal, topping up credits, and saving or removing provider keys. Anyone else gets 403 owner_only.
These also only work from the app, as described below.
App only
An API key belongs to a workspace, not to a person. So endpoints that act for a person only work when someone is signed in to the app, and an API key gets 400 session_only there.
That covers every owner-only endpoint above, plus creating a workspace, leaving one, syncing your account, and keeping what you made as a guest.
Each of these endpoints says so in its description.