Skip to content

Authentication

How to create the key, where to store it, what each 401 error means and what to do if it leaks.

Updated on Aug 09, 2026

Every request needs an API key in the Authorization header. The key identifies your account and is what usage is billed against — treat it like a password.

Create the key

  1. 1

    Sign in to the dashboard

    Go to platform.hinow.ai with your account.

  2. 2

    Go to API keys

    Open API keys, create a key and name it after the environment where it will be used — producao, local, ci.

  3. 3

    Copy it right away

    The key starts with hi_ and is shown only once. If you lose it, there is no way to recover it: generate another one and delete the previous key.

Generate your API key

Go straight to the keys area. If you do not have an account yet, sign in through the platform first.

Create API keyCreate account

Use it in the request

terminalbash
curl https://api.hinow.ai/v1/chat/completions \
  -H "Authorization: Bearer $HINOW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "hinow/higenesis",
    "messages": [{"role": "user", "content": "oi"}]
  }'

In the OpenAI-compatible SDKs, the key goes in the client constructor and the header is built for you:

client = OpenAI(
    api_key=os.environ["HINOW_API_KEY"],
    base_url="https://api.hinow.ai/v1",
)

When authentication fails

ResponseCauseWhat to do
AUTH_MISSINGThe request went out without the Authorization headerCheck that the environment variable reached the process
AUTH_INVALID_FORMATThe header came in empty or in the wrong formatThe value is Bearer followed by the key, with a space between them
AUTH_TOKEN_INVALIDThe key does not exist, has expired or was revokedGenerate a new one in the dashboard and replace it in the environment

All three come back with status 401 and a body in this format:

resposta de errojson
{
  "error": {
    "code": "AUTH_TOKEN_INVALID",
    "message": "Invalid or expired API token",
    "num_code": 1003,
    "timestamp": "2026-08-08T18:16:17Z"
  },
  "success": false
}

Where to store it

One key per environment. Production, staging and each person's machine use different keys. When one leaks, you revoke only that key and nothing else stops.

Always in an environment variable. Never in the code, never in a versioned file. Add .env to .gitignore before the first commit, not after.

Never in the browser. Code that runs on the client is visible to anyone who opens the inspector. Calls to HiNow go out from your server, and the browser talks to your server.

api/chat.jsjavascript
// O navegador chama a sua rota; a sua rota chama o HiNow.
// A chave nunca sai do servidor.
export async function POST(request) {
  const { question } = await request.json();

  const response = await fetch('https://api.hinow.ai/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      Authorization: `Bearer ${process.env.HINOW_API_KEY}`,
    },
    body: JSON.stringify({
      model: 'hinow/hinova',
      messages: [{ role: 'user', content: question }],
    }),
  });

  if (!response.ok) {
    // Não repasse o corpo do erro ao navegador: ele pode conter detalhes
    // internos. Registre no seu log e devolva algo genérico.
    console.error('hinow', response.status, await response.text());
    return Response.json({ error: 'upstream_failed' }, { status: 502 });
  }

  const data = await response.json();
  return Response.json({ answer: data.choices[0].message.content });
}

If the key leaks

  1. Revoke it in the dashboard. Revocation takes effect immediately and does not affect the other keys.
  2. Generate a new one and update the environment that used it.
  3. Check the usage for the period to find out whether anyone actually used it.

Rotating keys from time to time is worthwhile even without an incident — especially when someone leaves the team.

Key ready. What now?

Make the first call and watch the response arrive on screen.

Getting started
Was this page helpful?