Header
Authorization
Authorization: Bearer $HR_API_KEY
Server-only rule
- Use the key from backend code only.
- Return product-shaped responses to the browser.
- Proxy file previews and downloads through authenticated product routes.
- Do not forward caller-controlled org, member, Workspace, or harness IDs without server-side validation.
Open standard
This page's server-only Bearer rule is the client-side counterpart of UHP's credential requirements, which forbid a credential from ever appearing in a response body, event, log line, or artifact. See credential rules in UHP's Security chapter.
Create API Key
Ready to run this against a live workspace? Keys take under a minute.

