切换到 中文 / Switch to 中文

H3Hub has three ways to authenticate: API Key, Bearer token, and browser session. For automation, use an API Key. The web frontend uses a browser session.

Send it in a header:

X-API-Key: h3k_xxxxxxxx

Create a key with POST /api/v1/me/api-keys. The plaintext api_key is shown only once. If you lose it, create a new one and revoke the old one with POST /api/v1/me/api-keys/{key_id}/revoke.

Use a separate key for each automation task. If one script breaks or a key leaks, you only revoke that key.

Bearer Token

After login you get an access_token:

Authorization: Bearer <access_token>

If the Bearer token starts with h3k_, it is treated as an API key.

Browser Session

The web frontend uses an httpOnly cookie. You do not need to send an auth header manually. Scripts do not need this.

Access Control

There are three levels of control, managed by admins:

  • Global switch API_KEY_AUTH_ENABLED=false: all API keys stop working immediately, but web login still works.
  • User-level switch: an admin can disable API access for one user without affecting web login.
  • Key-level switch: an admin can disable an individual key.

Disabled credentials return 401. If that happens, ask an admin whether the key was disabled before creating a new one.