Creating and revoking developer API keys (hk_live_)

Developer API keys let you call the HIIE public API and MCP server from your own code or agents. You create, list, and revoke them from your account's Developer area.

Where to manage keys

Go to Account > Developer. From there you can create a new key, see your existing keys, and revoke any of them. Keys are used to call the public v1 API and the MCP server.

Key format

Keys follow a Stripe-style format: hk_live_<id>.<secret>. The leading id portion enables a fast lookup, and the secret is verified in constant time on the server.

How keys are stored

HIIE never stores your raw key. Instead it stores a one-way hash (HMAC-SHA256 of the key using a server-only secret). The raw hk_live_ value is shown to you exactly once, at creation, and is never stored or shown again.

Scopes

Each key carries scopes that control what it can do. The default scopes for a new key are read, write, and build (build is the scope that spends credits). See the dedicated scopes article for details.

Revoking a key

If a key is lost or compromised, revoke it from Account > Developer. Revocation takes the key out of service so it can no longer authenticate requests. Because the raw secret can't be recovered, the right response to a lost key is always to revoke and mint a new one.

Using a key

Send the key as a Bearer token against the base URL /api/v1, and reference the docs at /api.md and /.well-known/openapi.json.