Mutation operations (PATCH, DELETE) require an edit_key in the request body. Edit keys are opaque strings returned by POST /seeds and are never stored in the capsule. They are the sole authorization mechanism for updating or deleting a seed.
Registries MAY implement API key authentication (e.g. Authorization: Bearer sk_...) for extended features such as named seeds, higher rate limits, or permanent TTLs. API key handling is outside the scope of this specification.