Production: API is https://api.dropspot.dropsa.co.za (TLS 443). Prefer admin JWT in Authorization; ops secret is optional break-glass. Local dev only: http://localhost:3010.