Keys
How to send a key, who holds one, and why one is refused.
Send your key on every request, in either header:
curl -H "x-api-key: hck_…" https://hockay.com/api/v1/teams
curl -H "Authorization: Bearer hck_…" https://hockay.com/api/v1/teamsKeep keys on a server. A key in a web page or an app bundle is a key anyone can read.
Your keys
hck_ keys are yours: issue, name, and revoke them from your account. An account holds three at a time. A key works while its owner has access: on the roll, or let in by Le Council. A sociétaire whose membership lapses keeps their keys; they stop working within a few minutes and start again on renewal.
When a key is refused
| Status | code |
Meaning |
|---|---|---|
| 401 | missing_key |
No key on the request. |
| 401 | invalid_key |
The key is unknown, revoked, or expired. |
| 403 | no_access |
The key’s owner has no access right now. |
| 403 | forbidden |
The account cannot use the API, or this key cannot be used here. |