Keys and access
Every call carries a key. The owner of the firm makes one in Settings, under Your software.
Before a key will work
The firm needs an approved account. Every firm here is looked at by a person before it can post or quote, and the API does not go around that. An unapproved firm gets a 403 whatever key it holds.
Sending the key
Authorization: Bearer hb_live_...Server side only. A key in a browser, a mobile app or anything else a person can open is a key anybody can read.
Test keys and live keys
Tick the test box when the key is made and it starts hb_test_ instead of hb_live_. The prefix differs so a key in a log or a config file says which board it writes to without anybody looking it up. Pointing at the wrong one is the commonest accident there is.
| Test key | Live key | |
|---|---|---|
| Load is created | Yes | Yes |
| Shows on the board | No | Yes |
| Carriers told | No | Yes |
| Webhooks fire | Yes | Yes |
| Anything billed | No | Only when a job is agreed |
carriersAlerted | null | A number |
A test key reads back only its own test loads, and a live key only real ones. That is deliberate: it means you cannot accidentally act on a sandbox job in production.
Looking after the key
- It belongs to the firm, not to whoever made it, so it keeps working when people move on.
- It is shown once. We keep only a fingerprint, so nobody here can read it back to you.
- Revoke it in Settings the moment it might have leaked. It stops on the next call.
- Make a separate key per system, so revoking one does not stop the others.
Something not right? Tell us and a person will answer.