API key (nskey_live_...) or JWT token. API key is checked first;
if not found, falls back to Devise JWT authentication.
^#[0-9a-fA-F]{6}$^#[0-9a-fA-F]{6}$^#[0-9a-fA-F]{6}$Signed blob ID or URL
Updated brand
Logo URL
True when brand_color and company_name are set