# Authentication

Part of the HebrewCore documentation. Web: https://hc.itsbaba.com/docs#auth · Whole docs: https://hc.itsbaba.com/docs.md · Index: https://hc.itsbaba.com/llms.txt

Machine-to-machine requests authenticate with an **API key** sent as a bearer token. Keys come in two modes, `hc_live_…` and `hc_test_…`. Both work the same way, with the same limits and billing; use test keys to keep development traffic separate.

```http
Authorization: Bearer hc_live_…
```

Keys are shown once at creation and stored only as a hash. Create, name, and revoke them in the dashboard. The dashboard itself signs in with an email one-time code; the API never uses that session, only the bearer key.

An account can hold several active keys at once, which is how you rotate without downtime: create a new key, deploy it to your servers, confirm traffic has moved (the dashboard shows each key's last use), then revoke the old one. A revoked key stops working within 30 seconds.

> Treat keys as secrets. Use them from your server, never from untrusted client code or a device. Rotate immediately if one is exposed. The API accepts TLS 1.2 or newer only.