> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hypastack.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & Scopes

> Bearer tokens, and the six scopes a key can hold.

## Authentication

Every request carries your key as a bearer token. There are no cookies, no sessions, and no CSRF tokens, a browser session can never authenticate against this API, which is deliberate.

```text theme={null}
Authorization: Bearer hsk_EXAMPLE0000000000000000000000000000000000
```

Keys start with `hsk_`. Treat one like a password: it acts on your account with whatever permissions you gave it. Hypastack only ever stores a hash, so if you lose it, it can't be recovered. Make a new one and revoke the old, revoking takes effect immediately.

<Warning>
  Keep keys out of source control and out of client-side code. Anything in a browser bundle is public.
</Warning>

## Scopes

Each key carries its own permissions, chosen when you create it. Nothing is implied, a key with `files.read` cannot upload, and one with `files.write` cannot delete. Give each key the least it needs, so a leak costs as little as possible.

| Scope          | What it grants             |
| -------------- | -------------------------- |
| `files.read`   | Read files                 |
| `files.write`  | Upload files               |
| `files.delete` | Delete files               |
| `cdn.read`     | Read CDN assets            |
| `cdn.write`    | Upload and swap CDN assets |
| `cdn.delete`   | Delete CDN assets          |

Calling an endpoint without its scope returns `403 insufficient_scope`, and the message names the scope you need.