API Keys
Create named API keys from the setup surface after the connection is approved. The full key is shown once; HelvCore stores only its hash at rest. API key metadata includes name, environment, scopes, created time, last-used time, expiry, and status. Keys can be rotated or revoked. Revoked or expired keys fail with structured 401 errors, and successful calls update last-used metadata.
API key lifecycle
Name the key after the backend or job using it, such as ERP backend production.
Place the full key in server-side secrets only, for example a Supabase secret. The full key is shown once.
Create or rotate keys without changing the API shape. Old keys can be revoked immediately.
HelvCore stores only the key hash, created time, last-used time, expiry, scopes, and audit events.
API keys are the only credentials a client backend uses for normal /v1/* business endpoints. Access-session tokens are browser-console sessions; setup tokens are one-time onboarding credentials and must not be used as integration keys.
Related API reference
Use the endpoint reference pages for request schemas, response bodies, status codes, and examples generated from the live OpenAPI contract.