Use Authorization: ApiKey ... header instead of access_key in query string (updated guidance in August 2026).