API Key (recommended for automation)

Send the key in a header:

X-API-Key: h3k_xxxxxxxx

API keys are shown only once at creation. Create one with POST /api/v1/me/api-keys and revoke with POST /api/v1/me/api-keys/{key_id}/revoke.

Bearer Token

After login you receive an access_token:

Authorization: Bearer <access_token>

A Bearer token starting with h3k_ is equivalent to an API key.

Browser Session

The web frontend uses an httpOnly cookie; no manual auth header is needed.

Access Control

• The platform can globally disable API key auth (API_KEY_AUTH_ENABLED=false).
• Admins can disable API access per user or disable an individual key.
• Disabled credentials return 401; web sessions are unaffected.