Authentication & API keys

Every request sends the API key in the Authorization header:

Authorization: Bearer hk_live_9fK2…7Kp2

Two kinds of key

Key	Use for	Real money?
hk_test_…	Development, CI, demos. Can simulate transfers.	No – data fully separated
hk_live_…	Production	Yes

The explicit prefix lets you (and GitHub secret scanning) spot a leaked key immediately.

Create and manage keys

Dashboard › Settings › Developer › API keys. Creating a key requires two-factor confirmation. A key is shown once – Hensa stores only a hash; nobody (Hensa included) can display it again.

Each key shows “last used” – revoke keys that have been idle for a long time.

Protect your keys

• Keep keys on the server only (environment variables / secret manager). Never in browser code, mobile apps or Git.
• One key per system (website, app, accounting tool…) – a leak only requires revoking that key.
• Suspect a leak: create a new key → deploy → revoke the old one. Revocation is immediate.

Caution

Hensa will never ask for your API key or one-time codes by phone, email or message.

Authentication errors

HTTP	code	Cause
401	unauthorized	Missing header, wrong key, or revoked key
403	forbidden	The key lacks permission for this action
403	test_mode_only	A test-only endpoint was called with an hk_live_ key