Authentication

Every Hyperstack API request must include an API key. Keys are server-side secrets, never expose them in client-side code or commit them to a repository.

Generate an API key

1. Sign in to the Hyperstack console API Keys page.
2. Click Generate a New API Key.
3. Copy the key immediately. It is shown only once.

The key authenticates your requests to the Hyperstack API. It is personal to your user account, and a single key works across every environment and region in your organization. For creating, rotating, and deleting keys, see API Keys.

Send the key in requests

Pass your API key as the api_key request header. The header value is the raw key, with no prefix.

cURL

curl https://infrahub-api.nexgencloud.com/v1/core/virtual-machines \
  -H "api_key: YOUR_API_KEY"

Python

import requests

response = requests.get(
    "https://infrahub-api.nexgencloud.com/v1/core/virtual-machines",
    headers={"api_key": "YOUR_API_KEY"},
)

Node.js

const response = await fetch(
  "https://infrahub-api.nexgencloud.com/v1/core/virtual-machines",
  { headers: { api_key: "YOUR_API_KEY" } },
);

If the header is absent (or the value is invalid or revoked), the API returns 401 Unauthorized.

Token format

The key is opaque, do not parse, transform, or split it. Use the entire value exactly as copied from the console.

Rotate an API key

API keys do not expire automatically. Rotate periodically and immediately if a key is suspected of compromise.

1. Generate a new key in the console.
2. Update every client that uses the old key.
3. Delete the old key in the console.

The old key continues to work until deleted. Generating a new key does not revoke the old one.

Security cautions

• Never commit keys to a repository. Use environment variables or a secrets manager.
• Never expose keys in client-side code. Browsers, mobile apps, and desktop apps with embedded keys are equivalent to public keys.
• Treat leaked keys as compromised. If a key appears in a public log, screenshot, or third-party system, delete it from the console immediately and generate a replacement.

Related

• Errors, 401, 403 causes and response shapes
• Rate limits, per-key rate ceilings and backoff guidance