How does the PHP SDK authenticate, and which API key permissions do I need?

I am wiring the PHP SDK into a service that also identifies logged-in users, so I want the credentials right before this ships rather than after.

My assumptions so far: the SDK authenticates with some kind of key, and since we call from the backend that key lives in server config, not in the browser. What I am not sure about is whether the key needs any particular permission given that we also identify users, and how failures surface if I get the credential wrong.

Can someone confirm how the SDK authenticates and what permission the key needs?