For endpoints that need their own sign-in (an API key, a bearer token, a session). Our paid tests sign in with it, and the endpoint's page says it was tested with a seller-provided account. It can earn any grade, up to an A.
/.well-known/paycheck.json. That proves you run the endpoint.