Get an SDK’s Composer versions
The version the site serves of one package (p2/fetchski/attract-cms-laravel.json): its own release’s, so after the site upgrades run composer update to install the new one; ~dev.json is always empty (every version is tagged).
Access: any API key of this site that is switched on and not past its expiry date, whatever its scopes and signing mode (npm and Composer can’t sign), sent as Authorization: Bearer fsk_… (what npm, pnpm, Bun and Composer’s bearer auth send); ApiKey fsk_… works too. The key’s network allowlist still applies (403). Anything else, the management key and a signed-in session included, gets 401.
Rate limit: each request spends one of the key’s own reads-per-minute (default 600); over it, 429 with Retry-After.