GET /v1/orgs and POST /v1/orgs accept only a logged-in dashboard session, not API tokens — an sk-ard_ token gets 401. API tokens belong to one organization, so they don’t need to list or create orgs. Every other endpoint on this page accepts API tokens.