Register a credential Popp uses to fetch a candidate's protected documentUrl. Stored at the organization-group level behind your API key. Only one credential is allowed per organization group; if one already exists, this returns 409 (update it with PATCH or remove it first). The token is write-only: it is encrypted at rest and never returned. Popp sends it as the {headerTokenKey} header over HTTPS. Authenticated with your API key alone.