API Key Authentication

The GET API Reference uses API key authentication. You generate and manage your key from the Hermon dashboard — no code required.

How to Use Your Key

Once you have a key, include it in every request to the GET endpoints using the x-api-key header:

x-api-key: sk_live_abc123...
Never expose your API key in client-side code, browser scripts, or public repositories. Always make API requests from your server and store the key in an environment variable.

Managing Your API Key

All key management happens in the Hermon dashboard under Settings → Integrations → API Keys.

Generate an API Key

In the Hermon dashboard, navigate to Settings → Organization. Click Generate Key. The full key is shown only once — copy it immediately and store it somewhere safe.

Only users with Owner or Manager roles can generate API keys.

View Key Info

After generation, you can return to Settings → Organization at any time to see your key's status, when it was last used, and when it was created. The full key is never shown again — only a short prefix for identification.

Regenerate a Key

If your key is compromised or you want to rotate it, click Regenerate in the API Keys section. A new key is generated and the old one is invalidated immediately.

Update all your integrations with the new key before regenerating — the old key stops working instantly.

Revoke a Key

To permanently disable API access, click Revoke. All requests using the revoked key will immediately receive a 401 Unauthorized response. A new key must be generated to resume submissions.

Revoking is permanent and cannot be undone.

Security Best Practices

Environment Variables

Store your API key in an environment variable — never hardcode it in your source files.

Secure Hashing

API keys are hashed (SHA-256) before storage. Hermon cannot retrieve the plaintext key after generation.

Organization Isolation

Keys are scoped to your organisation — a key cannot be used across multiple orgs.

Key Rotation

Rotate your key periodically using the Regenerate option in the dashboard.

Emergency Revocation

If you suspect a key has been exposed, revoke it immediately and generate a new one.