FusionAuth Disable Public API Access toggle and admin API permission boundary

FusionAuth provides tenant-level controls for public API access and API keys with assignable permissions. The goal is to keep administrative endpoints non-public while allowing specific public-facing flows such as registration and password reset to remain available when intended.

The current design includes a Disable Public API Access toggle per tenant and API keys that can carry super-user privileges. The permission boundary between unauthenticated public access, key-authenticated access, and the toggle state is not clearly defined for mixed scenarios. Additionally, API request logging can create an indirect exposure vector if logs containing Authorization material are forwarded to accessible storage.

What is the expected interaction between the Disable Public API Access toggle and API key-authenticated requests to admin endpoints? Does the toggle restrict only unauthenticated calls, or does it also affect key-authenticated access when a key has elevated scopes? Is there a documented way to enforce that keys with super-user privileges are only usable from server-side contexts without relying on external secret management?