Authentication

Two caller types. Do not mix them on the same request.

Agents: x402

No API key. Attach an x402 payment payload for the published per-call price, in USDC, on Base or Solana. Header: X-Payment. Unpaid calls receive 402.

Humans: API key

Pay with a card on the pricing page. A key is emailed on payment. The commercial API at https://api.hshintelligence.com authenticates with that key. Keys are stored hashed with SHA-256. Treat the key as a secret; we cannot retrieve the plaintext later.

Include the key as specified in the issuance email. We do not publish a second, unofficial header name here.

Webhooks

HMAC-signed. Verify the signature before acting on a payload. Rotate the secret if it leaks.

Errors

• 400Malformed request
• 401Missing or invalid key
• 402Payment required (x402)
• 429Throttled
• 500Server error