The API key used to live only in process memory, so restarting Studio,
switching models, or toggling Disable/Enable silently invalidated every
external client that was using it. Users had to reopen the dialog, copy
the new key, and update their scripts each time.
Key state is now stored at ~/.unsloth/studio/auth/access_endpoint.json
(atomic write, mode 0600). The file survives backend restarts and
model load/unload. Disable preserves the key on disk and only clears
it from app.state, so Enable brings the same key back. Loading a
different GGUF keeps the endpoint running transparently under the new
model identifier.
Rotation is an explicit user action: a new JWT-protected
POST /access-endpoint/regenerate route mints a fresh key and is wired
to a "Regenerate" button next to the API Key field in the dialog.
Deliberately not dual-auth so a leaked key cannot rotate itself.
8a574de915