API keys
Only tenant_admin and superadmin can create API keys. Keys map to roles via scopes (documents:write → operator, modules:write → tenant_admin, platform:admin → superadmin). Store the token once — it is shown only at creation.
Help articles never claim live Peppol connectivity from the sandbox.