Authentication
Authenticate server-side requests with a Bloodhound API key.
Send the key in the Authorization header on every protected request.
Authorization: Bearer bh_live_...API keys identify one Bloodhound account. A key cannot read or continue a mission owned by another account.
Keep keys on the server
Never expose a Bloodhound key in browser code, mobile binaries, public repositories, analytics, or application logs.
Authentication failures
| Status | Meaning |
|---|---|
401 | Missing, invalid, expired, or revoked key |
403 | Valid key, but the mission belongs to another account |
Next steps
Learn how to create and rotate keys, then make the first call.