Skip to main content
Every request to the HalfPage API is authenticated with an API key sent as a bearer token in the Authorization header:
Requests without a valid key receive 401.

​
Create an API key

Keys are created in the HalfPage dashboard — they cannot be minted through the API.
1

Open the dashboard

Sign in at halfpagetechnologies.com and go to Settings → API Keys.
2

Create a key

Only organization admins can create, list, or revoke keys. Give the key a descriptive name (and, optionally, an expiry date).
3

Copy it immediately

The full key (hp_live_…) is shown once, at creation, and never again. Copy it and store it in a secret manager right away. If you lose it, revoke it and create a new one.

​
Use the key

Send the key as a bearer token on every request. For example, listing the available models:
Keep the key in an environment variable (e.g. HALFPAGE_API_KEY) rather than hard-coding it. Never commit it to source control or expose it in client-side code.

​
What a key can access

A key is scoped to the organization that owns it. Every image, prediction, and segmentation you create or read is confined to that organization — you can never reach another org’s data with your key. Keys work only on the public product surface:

Reachable with an API key

upload · predict · export · models — the ten endpoints in the API reference.

Dashboard (browser) only

Model training and annotation editing, folder/project organization, and organization, billing, API-key & platform admin.
Using a valid key against anything outside the product surface returns 403 ("API keys cannot access this endpoint"). The allowlist matches whole paths, so undocumented endpoints are unreachable even when they sit under a public prefix. API keys also cannot manage API keys — key creation and revocation require an admin browser session.

​
Key lifetime

A key stops working when any of the following happens:
  • It is revoked from the dashboard.
  • Its optional expiry date passes.
  • The admin who created it leaves the organization — a key never outlives its creator’s membership.
Treat API keys like passwords. Anyone with your key can run analyses and read your organization’s data, metered against your plan. Rotate keys periodically and revoke any key you suspect has been exposed.