Auth and limits
One bearer token. Two modes.
hk_test_... keys route to the sandbox: nothing real is contacted
and nothing is charged. hk_live_... keys reach real businesses.
Test keys are self-serve; live keys are granted on request.
Authorization: Bearer hk_test_...
Clients that cannot set headers (some MCP clients) may pass
?key= instead.
Scopes
| Scope | Grants |
|---|---|
tasks:read | Read tasks, their events, evidence, and cost. |
tasks:write | Create tasks, answer decisions, cancel. |
businesses:read | Browse the AI-Ready directory and read capabilities. |
webhooks:write | Register and list webhook endpoints. |
A call missing a scope returns 403 naming the
scope it needed.
Limits
Daily task quotas are counted per key mode and reset at
00:00 UTC. Over quota returns 429 with used,
limit, and remaining, so you can wait rather than
retry blind. Dry runs are free and never counted.