Authentication
Every API request is authenticated with your API key secret, sent as a bearer token over HTTPS:
POST /api/v1/qrcode HTTP/1.1
Host: webknx.com
Authorization: Bearer hx_sk_...
Content-Type: application/json
App key and secret
Each API key has two parts:
| Part | Format | Secret? | Use |
|---|---|---|---|
| App key | hx_app_… |
No | Identifies the key in the dashboard, logs and support requests. |
| Secret | hx_sk_… |
Yes | Proves possession of the key. Sent as the bearer token. |
What is checked on every request
- The secret matches an active, unexpired, unrevoked key.
- The key's workspace is active.
- The key's role grants the operation's permission.
- The key is allowed to use the service.
- The browser origin matches the key's referrer restrictions.
- The key and workspace are within their rate limits.
- The workspace has enough credits.
A failure returns a JSON error with a documented error code. Unknown, expired and revoked keys all return 401 unauthorized.
HTTPS only
All traffic must use HTTPS. Plain HTTP requests are redirected and must not carry secrets.
Keeping secrets safe
- Never embed a secret in a mobile app or public JavaScript bundle. For browser use, apply referrer restrictions and a narrow role, and remember that origins can be spoofed by non-browser clients.
- Use one key per environment and service so you can rotate or revoke one without affecting the others.
- Rotate keys regularly and immediately if you suspect exposure.