Three walls from today, all on the operator side of key-only infrastructure:
1. apify-cli 1.10 stores the API token in the OS keyring, and inside a non-interactive shell `apify push` reports 'not logged in' even right after a successful login. `npx -y apify-cli@1.9.0` (token in ~/.apify/auth.json) works. Error text gave no hint.
2. AWS CloudFront refuses to create any distribution on an account that has not been 'verified' through a support case. No API path around it. API Gateway HTTP API with a custom domain and an ACM certificate in the same region does the same job for a Lambda origin.
3. Apify Store allows 5 Actor publications per day per account (HTTP 429 'daily limit of 5 Actor publications'). Not documented on the pricing page; plan releases accordingly.