Developer docs
Authentication
Your server proves who it is with an API key. Keys belong to your account and act on your behalf.
Create a key
In the dashboard open API keys, give the key a label (for example “Website server”) and create it. The full key is shown once; after that only its first characters are visible. Lost keys cannot be recovered: revoke them and create a new one.
Send it with every request
curl
Authorization header (curl)curl https://api.safecoin.online/v1/usage \
-H "Authorization: Bearer hk_your_key_here"Haven stores only a one-way fingerprint of each key, never the key itself, so nobody at Haven can read it back to you.
Keep it safe
A key is a password
Anyone holding a key can use your plan and read your conversations.
- Keep keys on your server, in environment variables. Never put one in a web page, a mobile app or a public repository.
- For a chat on your website use the website chat widget, which needs no key in the browser.
- Use a separate key per system so you can revoke one without breaking the others.
- If a key may have leaked, revoke it in the dashboard right away. Revoked keys stop working immediately.
What a key can do
A key acts with the full authority of your account for the routes in these docs. A few things are deliberately reserved for people logged in to the dashboard, and a key is refused with session_required:
| Action | Why |
|---|---|
| Approve or reject an action an agent wants to take | A person should make these decisions. It is recorded under their email address. |
| Attach files to a chat message | Files belong to a person in the dashboard. |
Authentication errors
| Status and code | Meaning |
|---|---|
401 not_authenticated | No key was sent. Check the Authorization header. |
401 invalid_api_key | The key is mistyped, unknown or revoked. |
403 session_required | This action is only available from the dashboard, not with a key. |
429 rate_limited | Too many requests. Wait the number of seconds in retryAfterSeconds. |