Authentication

Bearer Header

Include your API key as a Bearer token in the Authorization header on every request:

header

Authorization: Bearer hb_adm_xxxxx...

API Key Types

Headband issues two types of API keys per project. Each key automatically scopes all operations to the project it belongs to.

Admin Key

Prefix: hb_adm_
Full access -- create indexes, push and delete documents, manage settings, and search. Keep this key on your server; never expose it to clients.

Search Key

Prefix: hb_src_
Search and analytics -- search, list indexes, view settings and stats, and write analytics or experiment events. It cannot read raw documents or mutate indexes, settings, or documents. Safe for client-side and frontend use when scoped to the right indexes.

Permissions

ActionAdmin KeySearch Key

SearchYesYes

List indexesYesYes

Get index infoYesYes

View settingsYesYes

View statsYesYes

List tasksYesYes

Read raw documentsYesNo

Create indexYesNo

Delete indexYesNo

Add/update documentsYesNo

Delete documentsYesNo

Update settingsYesNo