Authentication and keys

Every API request is authenticated with an API key sent as a bearer token. You create and delete keys yourself at /settings/api-access.

Create a key

1. Open API Access

   Go to /settings/api-access while signed in to your Enterprise account.

2. Name the key

   Type a name in the Key name field. Name it after the system that will use it, such as crm-sync or staging, so you can tell keys apart later.

3. Generate

   Click Generate. A green New API Key Created box shows the full key with a copy button.

4. Store it now

   Copy the key into your secret manager. The page warns "Save this key now. You won't be able to see it again." Once you close the box, the full key is never shown again.

Keys start with hr_. Each key in the list shows its name, when it was created and, once used, when it was last used.

Send the key

Put the key in the Authorization header with the Bearer prefix, exactly like this:

Authorization: Bearer hr_your_key_here

curl https://www.hackathonradar.com/api/stats \
  -H "Authorization: Bearer $HACKATHONRADAR_API_KEY"

The Bearer prefix is case sensitive and needs the space. Keys in the query string are not accepted. Call https://www.hackathonradar.com, not the bare domain, because most clients drop the header when they follow the redirect.

Every successful request updates the key's Last used time on the settings page.

Check a key with the validate endpoint

POST /api/api-keys/validate tells you whether a key is live without touching any data. It takes the key in the JSON body, not in a header.

curl -X POST https://www.hackathonradar.com/api/api-keys/validate \
  -H "Content-Type: application/json" \
  -d '{"api_key": "hr_your_key_here"}'

{
  "valid": true,
  "userId": "user_2abc...",
  "keyId": "3f1c2b9e-..."
}

A body without api_key returns 400 API key is required. An unknown or deleted key returns 401 Invalid API key. Use it in a health check or at deploy time to catch a bad secret before your first real call. A successful check also updates Last used.

Rotate a key

There is no rotate button. Rotation is three steps, with no downtime:

1. Generate a replacement

   Create a new key with a name that marks it as the successor, such as crm-sync-2026-10.

2. Deploy it

   Swap the new key into your system and confirm requests succeed. The old key keeps working until you delete it.

3. Delete the old key

   Click the trash icon next to the old key. Its Last used time is a quick check that nothing still depends on it.

Revoke a key

Click the trash icon next to a key on /settings/api-access. The key stops working straight away, and requests with it return 401 Invalid API key. Deletion cannot be undone, so generate a new key if you need access again.

When your plan changes

Managing keys needs Enterprise. If your plan drops below Enterprise, /settings/api-access shows the upgrade screen and you can no longer generate or delete keys there, so delete any keys you no longer need before you change plans.

Keep keys safe

• Keep keys on the server. Never ship one in browser code, a mobile app or a public repository.
• Use one key per system or environment, so you can revoke one without breaking the rest.
• Store keys in your platform's secret store, not in your code.
• Delete keys that show no recent Last used time.
• If a key leaks, delete it first, then generate a replacement.

Every key acts as your account. Inbound submissions, suppression rules and saved views created with a key belong to the account that owns it, and every key on that account can read them.