Authentication and API keys
Issue and revoke a key
- Sign in to Heth and open Business.
- Open the integration screen using Connect.
- In API integration, use + to issue a key.
- Store the key as a secret in your server-side integration.
- To revoke a key, remove its entry on that screen. Update the integration when replacing a key.
Never use a key printed in a screenshot or documentation example. The documentation uses placeholders rather than usable credentials.
Request headers
| Header | Use |
|---|---|
x-api-key | Required for API-key authentication |
Content-Type: application/json | Required when submitting JSON |
For https://app.heth.me, the Heth gateway supplies the organization context. This rule applies to that host: do not assume it holds for a different platform API URL. An API key is bound to its own account and permissions.
Keys and user sessions are different
Transaction integration accepts an API key. Interactive wallet functions can require the signed-in user's Bearer session instead; a key does not automatically grant access to wallets, profile, usernames or every business feature. Customer subscription sessions are a separate type of authorization. Never substitute one token type for another or copy a seed into an integration configuration.
See capabilities and errors. An integration must request only the access needed for its task.