Skip to main content

​
API key authentication

Every Public API request must carry your API key in the X-API-Key header.
An Authorization: Bearer header is also accepted if that fits your HTTP client better:

​
Key format

The first segment identifies the key; the second is the secret.

​
Creating a key

Public API keys are self-service — you do not need to contact us.
1

Open Settings

In the Huntd Dashboard, go to Settings → API & webhooks.
2

Create the key

The org owner creates a new key. This does not affect any existing key.
3

Copy it immediately

The key is displayed once. Store it somewhere safe before closing the dialog.
We store only a SHA-256 hash of your key. If you lose it, it cannot be retrieved — create a new key and revoke the old one.
Keys for the Company Lookup API are provisioned differently — see Authentication for that flow.

​
Multiple keys and rotation

An organization can hold several active keys at once, so rotation needs no downtime:
  1. Create the new key.
  2. Deploy it to your services.
  3. Revoke the old key once nothing is using it.
Revocation takes effect immediately. A revoked key returns 401 INVALID_API_KEY on its next request.

​
Authentication errors

All four causes return an identical response body. This is deliberate — it prevents the endpoint from being used to discover which key IDs exist. Branch on error.code, never on message text.

​
Security best practices

Never hardcode a key in source. Read it from the environment or a secrets manager at runtime.
A key pushed to a repository — even a private one — should be treated as compromised and revoked immediately.
A key in browser or mobile code is readable by anyone using your app. All Public API calls should originate from your backend.
Separate keys let you revoke a single integration without disrupting the others, and make unexpected usage easier to trace.