Skip to main content

​
Authentication

Every request carries your key as a bearer token. There are no cookies, no sessions, and no CSRF tokens, a browser session can never authenticate against this API, which is deliberate.
Keys start with hsk_. Treat one like a password: it acts on your account with whatever permissions you gave it. Hypastack only ever stores a hash, so if you lose it, it can’t be recovered. Make a new one and revoke the old, revoking takes effect immediately.
Keep keys out of source control and out of client-side code. Anything in a browser bundle is public.

​
Scopes

Each key carries its own permissions, chosen when you create it. Nothing is implied, a key with files.read cannot upload, and one with files.write cannot delete. Give each key the least it needs, so a leak costs as little as possible. Calling an endpoint without its scope returns 403 insufficient_scope, and the message names the scope you need.