Authentication

Send the key#

curl https://api.hmbrd.dev/v1/models \
  -H "Authorization: Bearer $HUMMINGRELAY_API_KEY"

The OpenAI SDKs send this header for you when you pass api_key / apiKey. Keys always start with hr_live_; a string with any other prefix is rejected without a lookup.

Accounts and invitations#

Accounts are created by invitation only. An invite link lets you choose a login and a password and creates the account with its starting balance and a first API key. A link works once and expires 12 hours after it was issued. If yours expired, ask for a new one.

Create and revoke keys#

• Manage keys in the dashboard. A new key is shown once — copy it then.
• An account can hold up to 25 active keys. Revoke one to make room.
• A revoked key stops working on the next request.
• All keys of an account spend the same balance. The rate limit is counted per key (see Rate limits).
• Any active key also signs you in to the dashboard, next to your login and password. Treat keys like passwords.

Spend limits and expiry#

Both are optional and set when the key is created, under Options. They cannot be changed afterwards — create a new key instead.

• Spend limit — the most this key may spend, in US dollars, over its lifetime. It does not reset. The dashboard shows spent against limit. When the limit is reached the key answers 402 key_spend_limit_reached; other keys of the account keep working. Holds count against the limit while a request is in flight, so a nearly exhausted key can refuse a request the account balance could cover.
• Expiry — a date after which the key answers 401 api_key_expired.

Use them for keys you hand to someone else, put on a CI runner, or give to an agent you do not watch: a leaked key is then worth at most its limit, for at most its lifetime.

Share a key#

When you create a key you can ask for a share link — a way to hand the key to another person without pasting it into a chat.

• You get a link (hmbrd.dev/k/…) and a random 6-digit PIN. Both are shown once. Send them through different channels.
• The recipient opens the link, enters the PIN and sees the key — once. After that the link is dead.
• Five wrong PINs destroy the link. The key itself keeps working for you.
• The link lives for 1 hour, 24 hours or 7 days, as chosen. Revoking the key kills its link too.
• The key is stored encrypted under the link and the PIN together; we keep neither, so we cannot open a share link ourselves.
• A share link can only be made at creation, because that is the only moment the key exists in readable form.

Authentication errors#

{
  "error": {
    "message": "Missing API key. Send `Authorization: Bearer hr_live_…`.",
    "type": "invalid_request_error",
    "code": "missing_api_key",
    "param": null
  }
}