Authentication
Every Headcode API request is authenticated with an API key, sent as a bearer token. Keys are created and managed self-service in the dashboard at app.headcode.dev.
Signing in to the dashboard
Section titled “Signing in to the dashboard”The dashboard uses sign-in links rather than passwords. Enter your account’s email address and we send you a link; it works once and expires after 15 minutes. Opening the link lands you on a sign-in page — press Sign in there to start your session.
That extra press is deliberate, not friction for its own sake. Corporate mail scanners and link-preview services follow links in email before you ever see them, and a link that signed you in just by being opened would routinely arrive already spent. Because nothing happens until you press the button, a scanned link is still yours to use.
Two things to know:
- Your browser needs to accept cookies, both to confirm the sign-in and to hold the session. Sessions last 30 days; you can sign out at any time, or sign out everywhere if you suspect a session has leaked.
- Signing in requires an account that already has an email address on file. Buying a Starter or Pro plan creates one automatically — see Plans and rate limits; for a Free evaluation key, email [email protected].
Using a key
Section titled “Using a key”Send your key as a bearer token:
Authorization: Bearer hc_...Example
Section titled “Example”curl https://api.headcode.dev/v1/stations/KGX \ -H 'Authorization: Bearer hc_...'Keep keys server-side. Do not embed them in mobile apps, browser code or public repositories — and if one does leak, revoke it in the dashboard and create a replacement.
All endpoints require authentication.
For the plans available, what each unlocks, and the rate limits that apply, see Plans and rate limits. For creating, scoping and rotating keys, see API keys.