The console needs an operator account. Onboarding artwork writes to the registry and spends real time encoding, so the platform API is told who is asking rather than trusting whatever reaches it.