API Key Authentication

The Opt-In Submit API uses API key authentication. You generate and manage your key from the Hermon dashboard — no code required.

How to Use Your Key

Once you have a key, include it in every request to the opt-in endpoint using the x-api-key header:

x-api-key: sk_live_abc123...
Never expose your API key in client-side code, browser scripts, or public repositories. Always make opt-in requests from your server and store the key in an environment variable.

Managing Your API Key

All key management happens in the Hermon dashboard under Settings → Integrations → API Keys.

Generate an API Key

In the Hermon dashboard, navigate to Settings → Organization. Click Generate Key. The full key is shown only once — copy it immediately and store it somewhere safe.

Only users with Owner or Manager roles can generate API keys.

View Key Info

After generation, you can return to Settings → Organization at any time to see your key's status, when it was last used, and when it was created. The full key is never shown again — only a short prefix for identification.

Regenerate a Key

If your key is compromised or you want to rotate it, click Regenerate in the API Keys section. A new key is generated and the old one is invalidated immediately.

Update all your integrations with the new key before regenerating — the old key stops working instantly.

Revoke a Key

To permanently disable API access, click Revoke. All requests using the revoked key will immediately receive a 401 Unauthorized response. A new key must be generated to resume submissions.

Revoking is permanent and cannot be undone.

Security Best Practices

Environment Variables

Store your API key in an environment variable — never hardcode it in your source files.

Secure Hashing

API keys are hashed (SHA-256) before storage. Hermon cannot retrieve the plaintext key after generation.

Organization Isolation

Keys are scoped to your organisation — a key cannot be used across multiple orgs.

Key Rotation

Rotate your key periodically using the Regenerate option in the dashboard.

Emergency Revocation

If you suspect a key has been exposed, revoke it immediately and generate a new one.