An API key defined in your User API Client (or Delegate API Client - this feature is available only to customers enabled with delegation functionality). API Clients are as managed in the Embedder Portal

An authentication token representing a logged-in user. This token does not need to have been stepped up and cannot authorize operations that require Strong Customer Authentication (SCA).

An authentication token representing a logged-in user who has completed step-up authentication. Use this token for operations that require Strong Customer Authentication (SCA).

The Webhooks key can be found in the API Credentials tab in your Portal Page.