Authentication

Sending a key

Send it as a bearer token. This is the form every example in these docs uses and the one you should prefer.

curl https://api.example.com/v1/codes/101076 \
  -H "Authorization: Bearer hcapi_live_…"

If a bearer token is awkward in your client, the same key is accepted on an X-API-Key header. Never put a key in a query string: URLs are logged by proxies, browsers and error trackers, and a key in one is a key you have to rotate.

curl https://api.example.com/v1/codes/101076 \
  -H "X-API-Key: hcapi_live_…"

What a key looks like

Keys begin with hcapi_live_ followed by 32 random characters. Test keys, where issued, begin with hcapi_test_. The prefix is ours, a key never carries another organisation's name.

How keys are stored

We store a SHA-256 hash of the key and the first few characters for display. The full key is shown once, at creation, and cannot be recovered afterwards, not by you and not by us. If you lose one, create another and revoke the old one.

Revoking

Revoke a key from the dashboard. Revocation takes effect immediately; anything still using that key starts receiving 401 invalid_api_key. Create and deploy the replacement first.

When authentication fails