The "no account" framing undersells what's actually happening: routstr turns API access into a bearer-token problem, since Cashu ecash is the credential, not a login, so whoever holds the token holds ...