A couple of things here:
1. `$user` should be a UUID and named appropriately (`$user_uuid`). A `User` object would also be acceptable. Developers outside of AllPlayers do not have access to UIDs and this same method needs to work for store when we implement it.
2. The documentation for `$agent` is still very confusing. I have no idea what it is or what it will be used for.
3. The documentation for the private key should indicate that it is only used to sign the request.
4. This method name is deceiving. It sounds like it's actually doing authentication when it is not. A more appropriate name might be `setCredentials()`.