@ge0rg I assume some sort of allowlist. The number of legitimate API tokens couldn't have been more than a few hundred.