Only one active card per account — close the existing one before requesting another.

• Send any amount within the range returned by create_card — no need to specify an amount upfront.

• Sending more funds after a card is already active tops it up automatically, rather than creating a second card.

• Treat your API key as a bearer credential — anyone with it can act on your account. Rotate it from your dashboard if it's ever exposed.