When you connect a CMS or site renderer to Pendium to preview draft content, the integration previously required an API key. That key could end up in version-controlled config, a build environment, or anywhere else a contractor touches. Now, a short-lived preview token is enough to pull the drafts perspective — no API key required in that code path. The token is validated on every request, expires after an hour for this purpose, and gives access only to that brand's drafts. Everything else — published data, other endpoints — stays closed without a key.
Visibility scan runs now record whether the account had extended scan access at the time the scan executed, alongside the plan tier, platforms, and question cap that applied. This gives you an accurate audit trail if your access level changes between runs.