Remove API key requirement

README.md

@@ -136,45 +136,13 @@ If `APP_VERSION` is left unset the footer falls back to the project version
 from `CMakeLists.txt` (`project(... VERSION ...)`); a build that defines no
 version at all shows `unknown`. The Nix build sets `APP_VERSION` automatically
 to the flake package version, so a plain `nix build` needs no extra flags.
-With `--impure` the flake instead reads the `APP_VERSION` / `API_KEY`
-environment variables — this is how CI injects the version and portal key
+With `--impure` the flake instead reads the `APP_VERSION`
+environment variable — this is how CI injects the version
 (see the CI note under *Common Pitfalls*). Pure evals always get the package
 defaults, because `builtins.getEnv` cannot see the environment in pure
 evaluation mode.
 
-#### Portal API key
-
-Every portal request sends `Authorization: Bearer <key>`. The key is baked
-into the binary at build time via the `API_KEY` CMake cache variable. It is
-**optional** — when unset, requests go out without an auth header. Keep the
-real value out of the source tree and inject it at build time from your CI
-secret store so it never lands in `git`:
-
-```sh
-cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release \
-  -DAPI_KEY="${{ secrets.PORTAL_API_KEY }}"
-cmake --build build
-```
-
-Rotate the key by building with a new value and shipping the new binary. The
-Nix package accepts the same value via `callPackage ./nix/package.nix {
-apiKey = "…"; }`, or via the `API_KEY` environment variable with
-`nix build --impure`; the flake itself never embeds one.
-
-#### Version + API key in one configure
-
-`APP_VERSION` and `API_KEY` are independent CMake cache variables, so pass
-both — plus the build type — in a single configure:
-
-```sh
-cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug \
-  -DAPP_VERSION="1.2.3" \
-  -DAPI_KEY="${{ secrets.PORTAL_API_KEY }}"
-cmake --build build
-```
-
-`-D` values always win over the `APP_VERSION` / `API_KEY` environment
-variables, which `nix develop` seeds from the ambient environment.
+#### Version in one configure
 
 ### Building with Nix
 
@@ -187,14 +155,14 @@ nix build .#packages.x86_64-linux.default  # needs a Linux machine/builders
 nix build .#packages.aarch64-linux.default
 ```
 
-To bake in a custom version and/or portal key, build impurely — the flake
-reads `APP_VERSION` and `API_KEY` from the environment on impure evals:
+To bake in a custom version, build impurely — the flake
+reads `APP_VERSION` from the environment on impure evals:
 
 ```sh
-APP_VERSION="1.2.3" API_KEY="$PORTAL_API_KEY" nix build --impure .#default
+APP_VERSION="1.2.3" nix build --impure .#default
 ```
 
-A pure `nix build` always uses the package defaults (`0.1.0`, no auth header)
+A pure `nix build` always uses the package defaults (`0.1.0`)
 even if those variables are set in your shell, because pure evaluation cannot
 see the environment. CI uses `--impure` to inject them.
 
@@ -633,9 +601,9 @@ status to decide which page to show.
   workflow is `.gitea/workflows/build.yml`. It is **manual-only**
   (`workflow_dispatch`) — pick the branch when dispatching. `main` builds bake
   the current git tag as `APP_VERSION`; `dev` builds bake the current commit
-  hash. Both pass the portal key from the `RWT_API_KEY` secret and build with
-  `nix build --impure` (which lets the flake's env injection work). The
-  offline test suite runs in the package's `checkPhase`; the live portal tests
-  run from `nix develop` when the `RWT_LIVE_*` secrets are set.
+  hash. Both build with `nix build --impure` (which lets the flake's env
+  injection work). The offline test suite runs in the package's `checkPhase`;
+  the live portal tests run from `nix develop` when the `RWT_LIVE_*` secrets
+  are set.
 - Asset tests (`test_assets`) must pass before committing -- they catch missing
   fonts and images that would break the app at runtime.