API keys

The key (hyp1_…) is returned once. Store it in your application’s secret store; the server keeps only a verifier. → Credentials

Studio

API keys → Create key (an optional label). The dialog that shows the key ignores Escape and clicks outside — copy it, then Done. Revoke fails the key’s very next request. The Studio remembers the key in this tab for the Engine probe until you close it.

hcloud

hcloud key create prj_… --label app     # prints the key once; stored locally for `capabilities` unless --no-store
hcloud key list prj_…                   # key_id, label, created_at, revoked_at — never the secret
hcloud key revoke prj_… <KEY_ID>

curl

curl -X POST $ORIGIN/v0/projects/$PRJ/keys -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' -d '{"label":"app"}'
curl $ORIGIN/v0/projects/$PRJ/keys -H "Authorization: Bearer $TOKEN"
curl -X DELETE $ORIGIN/v0/projects/$PRJ/keys/$KEY_ID -H "Authorization: Bearer $TOKEN"

JavaScript

const issued = await cloud.keys.create(project.id, { label: "app" });   // issued.key, once
const { keys } = await cloud.keys.list(project.id);
await cloud.keys.revoke(project.id, issued.key_id);

Using the key on the data plane: Authorization: Bearer hyp1_… plus X-Hyphae-Protocol-Minor: 3 on /v2/*. The key alone selects the project.