The H3Hub public API only accepts API Keys. For external scripts and agents, send X-API-Key in the request header. The web frontend uses browser sessions, which external developers do not need to worry about.

API Key

API Keys can only be created on the https://h3hub.cn/account/ page and start with h3k_.

Send it in a header:

X-API-Key: h3k_xxxxxxxx

Use a separate key for each automation task. If one script breaks or a key leaks, you only revoke that key.

About Bearer Tokens

The access_token returned by login endpoints is an internal JWT for the web frontend. It is not accepted for external Bearer calls. The public API only accepts API Keys; do not use Authorization: Bearer ....

Browser Session

The web frontend uses an httpOnly cookie and sends it automatically. This is only for the web UI, not for scripts.