Groundcover CLI Invoke the binary (install via ). Source of truth is . Auth (required before any command) The key must be a service-account key: prefix , exactly 40 chars. Anything else is rejected with a clear message — or . Don't confuse key types: - — service-account key. This is the one query/CRUD commands need. - — ingestion key (data push). Will NOT authenticate the API; wrong type. A 401 with a correctly-formatted key means the key belongs to a different tenant than the one you're querying. If you don't have a key handy, mint one with using an already-valid key, then for the session. D…