Project API keys can restrict which services are callable (L1 service_caps), before RBAC and field policy apply.
Configure in project settings → API keys. null caps = all services allowed.
Related: FIELD_ACCESS_POLICY.md · ACCESS_AND_FIELD_POLICY.md