The most common way to access Twilio REST API is by using your primary Account SID and token. However, you may want to implement a separate access policy for different developers or subparts of your application by utilizing API Keys instead. This allows you to revoke access easily and at the right granularity.
Now, you are able to use the very same API Keys method for authenticating with Media Content Service (mcs.us1.twilio.com) to upload any attachments you would like to be sent over Programmable Chat.
Read more about API Keys support in the documentation.