Authentication and scopes
Every request carries one of your API keys. A key only does what you allowed, on the businesses you picked.
Send your key
Put it in the Authorization header. X-Api-Key works too. Keys start with hsk_.
Authorization: Bearer hsk_8fK2pQ1m…
Treat a key like a password. Keep it in an environment variable or a secret store, never in a public repository or a web page.
What limits a key
- Scopes
- Each key holds only the scopes you chose. A call outside them answers
403 missing_scope. - Businesses
- A key can be held to some of your businesses. The others answer
404, as if they did not exist. - Permissions page
- Each business's Permissions page still applies. If AI agents may not change DNS there, neither can a key.
- Expiry
- Pick an expiry when you make a key, or revoke it from the dashboard. It stops working at once.
Scopes
Each endpoint names the one scope it needs. High impact scopes can take a site down, send mail as you or spend your AI plan.
| Scope | Allows |
|---|---|
| Account | |
account:read |
Your profile, the businesses you can open, their state and uptime. |
billing:read |
Your services, prices, renewal dates and invoices. |
support:read |
Your support conversations and their status. |
| Servers | |
files:read |
List folders, read files, search code and read server logs. |
files:write |
Write, copy and unpack files. Can take a site down. High impact |
commands:run |
Run shell commands, or game-server console commands. High impact |
power |
Start, stop, restart or kill game and hosting servers. High impact |
backups:read |
List off-site backups and backup requests. |
backups:write |
Ask for a backup to be made or deleted. You still approve each one. |
| Domains | |
dns:read |
List zones and records. |
dns:write |
Create, edit and delete records. A wrong record takes a domain offline. High impact |
routes:read |
Which hostnames point at which folder. |
routes:write |
Put a site live on a hostname, or take it down. |
mail:read |
List mailboxes and read the messages in them. |
mail:write |
Create, change, import and delete mailboxes. |
mail:send |
Send email from your mailboxes. High impact |
marketing:read |
Contacts, lists, campaigns and their stats. |
marketing:write |
Add contacts, build and send campaigns. High impact |
| AI and tools | |
tools:read |
The server-side tools and their run history. |
tools:run |
Run a tool, like an SEO audit or image optimiser. |
browser |
Open your own sites in the business browser and act on them. |
council:read |
Read what the AI council answered. |
council:write |
Send the AI council a task. It uses your AI plan. High impact |