Skip to main content

Keys and authentication

Every request carries an API key in the Authorization header:

curl https://api.wfskills.com/v1/me -H "Authorization: Bearer hw_test_<your_key>"

Keep keys on your server. A key in a browser or a mobile app can be copied.

Test and live keys​

  • A test key starts with hw_test_. It answers the sandbox inputs and spends no credits.
  • A live key starts with hw_live_. It spends credits on every estimate.

Scopes​

ScopeAllows
estimates:writeCreate, answer and delete estimates.
estimates:readRead and list estimates.
tasks:readList tasks and regions.
usage:readRead usage and balance.
webhooks:manageManage webhook endpoints and read events.
customers:writeManage customers, with the Records add-on.
records:readRead records, with the Records add-on.
records:writeWrite and delete records, with the Records add-on.

Every key made in the dashboard carries the first five scopes, and the three of the Records add-on when the account has it. A request without the scope it needs answers 403 with the code scope_missing.

Manage keys​

Manage keys in the dashboard. Each change asks for your password when it was not confirmed in the last 10 minutes.

  • Create: the dashboard shows the secret once. Store it right away.
  • Rotate: you get a new key with the same name, scopes and addresses. The old one keeps working for up to 7 days.
  • Revoke: the key stops working at once. This cannot be undone.

Restrict a key to your servers​

List the addresses your servers call from when you create the key, up to 10, as single IPs or CIDR ranges. A call from any other address answers 403 with the code ip_not_allowed. To change the addresses, create a new key. During the beta, a live key needs at least one address.

Last updated on