Authentication

Admins create keys under Settings › Developers › Private apps, choosing the scopes each key gets. A key is shown once. Send it as a bearer token:

Authorization: Bearer hg_live_...

Rotate keys every 90 days; the old key keeps working for 24 hours after you rotate it.

Apps that other workspaces install use the OAuth 2.0 authorization code flow. Access tokens last 30 minutes; refresh tokens last until the app is uninstalled.

Scopes are named by object and access, such as contacts.read, contacts.write, deals.read, tickets.write and audit.read. A key with only .read scopes is read-only. A request outside its scopes gets a 403 response that names the missing scope.