docs: explain API key provisioning

sdks/javascript/docs/API.md

@@ -66,6 +66,8 @@ Type exports:
 
 ## Authentication
 
+Socialhose API keys are provisioned by Socialhose or by your account administrator. This SDK consumes an existing key; it does not create or manage keys.
+
 Every request sends:
 
 - `Authorization: Api-Key <apiKey>`

sdks/javascript/docs/GUIDE.md

@@ -20,6 +20,18 @@ npm install @socialhose/api
 
 Requires Node 18+ or a custom `fetch` implementation.
 
+## Getting API access
+
+Socialhose API keys are provisioned by Socialhose. This SDK only consumes an existing key; it cannot create, rotate, or discover keys for you.
+
+Ask the Socialhose team or your account administrator for a Public API key and confirm which campaigns it can access. Then set it in your server environment:
+
+```bash
+export SOCIALHOSE_API_KEY="sh_your_key_here"
+```
+
+Keep this value server-side. For browser applications, create your own backend endpoint that uses this SDK and returns sanitized data to the frontend.
+
 ## Basic setup
 
 ```ts