---
title: Keys
description: How to send a key, who holds one, and why one is refused.
sidebar:
  order: 2
---

Send your key on every request, in either header:

```bash
curl -H "x-api-key: hck_…" https://hockay.com/api/v1/teams
curl -H "Authorization: Bearer hck_…" https://hockay.com/api/v1/teams
```

Keep keys on a server. A key in a web page or an app bundle is a key anyone can read.

## Your keys

`hck_` keys are yours: issue, name, and revoke them from [your account](https://hockay.com/account/developers). An account holds three at a time. A key works while its owner has access: on the roll, or let in by Le Council. A sociétaire whose membership lapses keeps their keys; they stop working within a few minutes and start again on renewal.

## When a key is refused

| Status | `code` | Meaning |
|---|---|---|
| 401 | `missing_key` | No key on the request. |
| 401 | `invalid_key` | The key is unknown, revoked, or expired. |
| 403 | `no_access` | The key's owner has no access right now. |
| 403 | `forbidden` | The account cannot use the API, or this key cannot be used here. |