Why your API secret is shown only once at creation
When you create a developer API key, HIIE displays the full hk_live_ secret exactly once. After you close that screen it can never be retrieved again. This is a deliberate security design, not a limitation.
What HIIE actually stores
HIIE does not keep your raw key anywhere. It stores only a one-way hash: an HMAC-SHA256 of the raw key computed with a server-only secret. When you make a request, the server hashes the key you send and compares it (in constant time) to the stored hash. Because the stored value is a hash, the original secret cannot be reconstructed from it.
Why this matters
If raw secrets were stored, anyone with database access could impersonate your keys. By keeping only a hash, HIIE ensures that even an operator looking at the keys table cannot read your secret. This is the same pattern used for passwords and for Stripe-style API keys.
What to do at creation time
Copy the key immediately and store it in a secure secret manager or your project's encrypted environment. Treat it like a password.
If you lose a key
There is no recovery flow, because the secret was never stored. Go to Account > Developer, revoke the lost key, and create a new one. Update wherever the old key was configured.
A masked form persists
After creation, only a masked reference to the key remains visible so you can identify it in the list. The usable secret portion is gone for good once you navigate away.