One header, no handshake
There is no OAuth dance and no token to refresh. Create an API key in your
account settings, send it in the X-Virtbase-API-Key header, and every endpoint
is open to you.
Keys do not expire. They are shown once at creation, so store the key when you make it — and delete it the moment you no longer need it.