Authentication

Sending a key

Send it as a bearer token. This is the form every example in these docs uses and the one you should prefer.

curl https://api.example.com/v1/codes/101076 \
  -H "Authorization: Bearer hcapi_live_…"

If a bearer token is awkward in your client, the same key is accepted on an X-API-Key header. Never put a key in a query string: URLs are logged by proxies, browsers and error trackers, and a key in one is a key you have to rotate.

curl https://api.example.com/v1/codes/101076 \
  -H "X-API-Key: hcapi_live_…"

What a key looks like

Keys begin with hcapi_live_ followed by 32 random characters. Test keys, where issued, begin with hcapi_test_. The prefix is ours — a key never carries another organisation's name.

How keys are stored

We store a SHA-256 hash of the key and the first few characters for display. The full key is shown once, at creation, and cannot be recovered afterwards — not by you and not by us. If you lose one, create another and revoke the old one.

Revoking

Revoke a key from the dashboard. Revocation takes effect immediately; anything still using that key starts receiving 401 invalid_api_key. Create and deploy the replacement first.

When authentication fails