Authentication

Every customer feed request requires an active subscription and a key belonging to that account. Dashboard sessions and feed API keys are separate credentials.

Secret keys

Secret keys start with hp_sk_. Use them on servers, serverless functions, and static-site build pipelines. They can list the account’s configured feeds, read posts and status, and request refreshes.

Authorization: Bearer YOUR_SECRET_KEY

The X-API-Key header is also supported. Keys are not accepted in URLs. Requests with a browser Origin header must use a publishable key instead of a secret key.

Publishable keys

Publishable keys start with hp_pk_. Create them with a selection of feeds and exact website origins, such as https://example.com. Different schemes, hosts, subdomains, and ports are different origins. Wildcards and URL paths are not accepted. Localhost may use HTTP.

Publishable keys can only read selected feeds’ posts and status. They cannot list account feeds, request refreshes, or manage your account. A matching Origin header is required.

Publishable keys are public. Website visitors can see them, and non-browser clients can forge an Origin header. Use them only for feeds whose content is intended to be public. Origin restrictions do not provide confidentiality.

Replace or revoke a key

Create a replacement key, update your integration, and then revoke the old key. The dashboard’s Replace action pre-fills the old key’s settings without revoking it prematurely.

Revocations and subscription changes invalidate authorization caches. Authorization records otherwise live for up to 60 seconds, bounded by the subscription’s expiry.

Account access

The dashboard uses a verified Supabase session for /account/* operations. API keys cannot manage feeds, keys, or billing through those endpoints. Account and key records are not directly exposed through Supabase’s browser Data API.