Users should navigate to API Management after login, create an API key (i.e. name) and then perform secondary verification by phone or email. The key must be stored securely to prevent unauthorised access.