Authentication
Normal API clients authenticate against https://api.helvcore.ch/v1 with one server-side HelvCore API key: Authorization: Bearer $HELVCORE_API_KEY. The key is scoped to an environment, tenant, connection, end-customer, actor, and capabilities. API clients do not send Cloudflare Access service-token headers. Admin surfaces are protected separately by Cloudflare Access. API keys must never be exposed to browser JavaScript, logs, screenshots, or tickets.
One-key client model
curl https://api.helvcore.ch/v1/connection/status \ -H "Authorization: Bearer $HELVCORE_API_KEY"
Cloudflare protects the tunnel and admin surfaces. Normal API clients do not send Cloudflare service-token headers; HelvCore API key auth is the client contract.
Related API reference
Use the endpoint reference pages for request schemas, response bodies, status codes, and examples generated from the live OpenAPI contract.