Plesk API docs mentions a secret key feature, but no where does it say how to use the key in place of login/password in the header of the curl request.

How does the secret key change this?
CODE
$headers = array(
            "HTTP_AUTH_LOGIN: " . $user,
            "HTTP_AUTH_PASSWD: " . $pass,
            "Content-Type: text/xml",
        );

        $ch = curl_init();


Operator: <secret_key>

XML Schema: secret_key_input.xsd, secret_key_output.xsd

Plesk version: Plesk 7.5.6 Win | Unix 8.0 and later

API RPC version: 1.4.0.0 and higher

Plesk user: Plesk Administrator

Description

Plesk Administrator can access Plesk API RPC service using a secret key - alternative way of authentication. Instead of putting the credentials, Plesk Administrator can specify a secret key in the HTTP header of request packets.

Secondly question.
Is there an .xsd and methods for managing SpamAssasin on a per mailbox level via the api? turn it off/on, toggle reject spam.. anyone have a code sample?