Every statement below runs against the public read endpoint of gigi-stream.fly.dev — the same production instance the GIGI Builds exercise consoles use. No key, no signup, no sandbox: the response you see is what the engine said.
The public endpoint is an allowlist of read verbs. Statements outside it come back 403 — the engine answers "verb not allowed on the public read endpoint" rather than pretending. The console above turns that into a plain note.
Writes — SECTION … UPSERT, CREATE BUNDLE, deletes, admin verbs — need an API key on a private deployment. Run your own engine from GitHub or Docker Hub, start it with GIGI_CORS_ORIGIN=* for browser access (dev only), point the endpoint field above at it — the full verb list is in the docs.