API keys
An API key identifies your account and pays for calls from its credit balance. Keys look like hk_live_ followed by 43 random characters (256 bits). Only a salted SHA-256 hash of each key is stored.
Two kinds of account
| Anonymous key | Password account | |
|---|---|---|
| How to create | POST /v1/keys (no body needed) | POST /v1/auth/signup with email + password |
| Personal data stored | None | Email address and a password hash |
| Keys per account | 1 | Up to 20, each with a label prefix |
| Revoke a key | Not possible (stop using it, make a new account) | DELETE /v1/keys/<prefix> |
| Usage history | GET /v1/account (balance) | Plus GET /v1/activity and GET /v1/usage/daily |
Both kinds share the same credits, plans, coupons and referral features.
Create an anonymous key
bash
curl -s -X POST https://api.highlnd-intel.group/v1/keys \
-H "content-type: application/json" \
-d '{}'If someone referred you, pass their code so they get credit when you buy a plan (see Referrals):
bash
curl -s -X POST https://api.highlnd-intel.group/v1/keys -H "content-type: application/json" -d '{"ref":"k7m2q9xa"}'Key creation is rate-limited per IP address. A 429 rate_limited means wait a minute.
Create a password account
bash
curl -s https://api.highlnd-intel.group/v1/auth/signup \
-H "content-type: application/json" \
-c cookies.txt \
-d '{"email":"you@example.com","password":"at-least-12-characters","ref":"optional-referral-code"}'The response has api_key (shown once) and sets an HttpOnly session cookie. With that cookie you can manage keys:
list keys
curl -s https://api.highlnd-intel.group/v1/keys -b cookies.txtadd a key
curl -s -X POST https://api.highlnd-intel.group/v1/keys -b cookies.txtrevoke a key by its prefix (first 16 characters, as listed by GET /v1/keys)
curl -s -X DELETE https://api.highlnd-intel.group/v1/keys/hk_live_Ab12Cd34 -b cookies.txtLog in again later with POST /v1/auth/login and the same JSON body (email + password).
Use a key
Send it as a Bearer token on every paid request:
http
Authorization: Bearer hk_live_...| Where | How the key travels |
|---|---|
| REST | Authorization header |
| MCP clients that support headers | Authorization header on https://api.highlnd-intel.group/mcp |
| MCP clients that cannot set headers (claude.ai connectors, ChatGPT connectors) | In the path: https://api.highlnd-intel.group/mcp/<KEY> |
Store keys safely
- Use environment variables (
HIGHLAND_KEY) or a secret manager. Never commit keys to git. - In Cloudflare Workers:
npx wrangler secret put HIGHLAND_KEY. - In GitHub Actions: repository Settings → Secrets and variables → Actions.
- Give each app or agent its own key (password accounts), so you can revoke one without breaking the others.
Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | api_key_required | No Authorization header (and no x402 payment) |
| 401 | invalid_api_key | Unknown or revoked key |
| 409 | too_many_keys | A password account already has 20 active keys |
| 429 | rate_limited | Too many sign-ups from your IP; wait a minute |