Keys and security

• One key per use. Create separate keys for separate scripts or people, so one can be revoked without breaking the others.
• Shown once. We store only a keyed hash of each key, so we cannot show it again or recover it. If you lose a key, revoke it and create a new one.
• Revocable. Revoking or rotating a key in the customer app takes effect on the next call.
• Live and test. hr_live_ keys read real data and count toward your plan. hr_test_ keys are for building and testing.
• Organizations. Keys belong to an organization, not a person. Everyone in the organization shares its plan and its limits, and each key’s usage is recorded separately.

Send the key only in the Authorization header, never in a URL. Download links returned by the API are signed for one file and expire, so they can be handed to a script without the key.

Report a leaked key or a security problem to security@heimdallresearch.com.