Mobile app endpoints (/app-api/v1). Set **Authorize** once (Bearer + client-apptype / client-appver / client-cwkey). Client headers apply to every Try it out — including JWT-free routes (no lock). Bearer applies only to locked routes.
Web client endpoints (/web-api/v1). Set **Authorize → client-webver / client-cwkey** once; values apply to every request. Required headers: `webver`, `cwkey`.