Authentication

How keys work, and how to keep them safe.

Every request carries one of your keys. Keys start with hph_live_. Send it either way. The gateway accepts both:

x-api-key: hph_live_YOUR_KEY

The Anthropic SDKs use x-api-key. Claude Code (via ANTHROPIC_AUTH_TOKEN) uses Authorization: Bearer.

Many keys, one wallet

All your keys draw from the same Naira balance. Create one key per app, teammate or environment so you can see usage per key and revoke one without touching the rest.

Spending caps

Give any key a cap (for example ₦10,000). When that key's lifetime spend reaches the cap, it returns 402 until you raise it. A runaway agent loop can't drain your wallet. Set caps under API keys.

Keeping keys safe

• Keep keys on your server. Never put one in a browser app, mobile app or public repo.
• Load them from environment variables, not source code.
• If a key leaks, revoke it on the keys page. It stops working immediately. Then create a new one.
• We store only a hash of each key, so we can't show it to you again, and neither can anyone else.