Authentication
One bearer key authenticates both the REST API and the MCP server. A key beginning ho_test_ is a sandbox key and a key beginning ho_live_ spends real money; sandbox is a property of the key, so there is no second base URL and nothing to change when you go live.
One key, both transports
Send it as a bearer token. The MCP server takes the identical header, and both share one rate-limit bucket — switching transport does not buy a second budget.
curl -s "https://quiescence.eu/humanops/api/v1/tasks" -H "Authorization: Bearer ho_live_…"
# X-Api-Key is accepted too, for clients that cannot set Authorization
curl -s "https://quiescence.eu/humanops/api/v1/tasks" -H "X-Api-Key: ho_live_…"Sandbox is a property of the key
| Prefix | What it does |
|---|---|
ho_test_ | Sandbox. Completes on a timer with synthetic evidence. No money moves, no ledger row is written, no person is contacted. |
ho_live_ | Real. Holds the price against your prepaid balance and dispatches a verified person. |
There is no second base URL and no ?sandbox=true. That is deliberate: an environment flag you can forget to change is an environment flag that eventually sends a test order to a real person, or bills a customer for a fake result.
Scopes
A key carries tasks:read, tasks:write or both. A read-only key can quote, list and collect but cannot order or cancel — over REST it gets forbidden_scope, and over MCP the write tools refuse with the same code. Give your polling worker a read-only key and keep the spending one somewhere smaller.
Keys are shown once
We store a SHA-256 hash and a prefix, so nothing can re-display a key — including us. Lose it and mint a new one; a console that can show you your key is a console that shows everyone their keys the day it is compromised.
Revoked is not the same as unknown
A revoked key answers key_revoked, an unrecognised one answers unauthorized. Both are 401, and the distinction matters at three in the morning: one means you rotated something, the other means you are sending the wrong string.
Rotate by minting the new key, deploying it, then revoking the old one. Both work in between, so a rotation is never an outage.