Keys are created from the Developers → API Keys page. The full key is shown exactly once at creation — it is stored hashed and can never be retrieved again. Live keys start with hlh_live_, test keys with hlh_test_.

Missing or invalid keys return 401; a key without the required scope returns 403.

Each key carries an explicit scope list; every endpoint documents the scope it needs.

Note: case endpoints deliberately use the collections:* scopes (matching the internal permission model) — there is no cases:* scope.