Authenticate your first request

Helio's API uses scoped API keys for authentication. Every request must include a bearer token; requests without one return a 401. This guide covers creating a key, scoping it, and making your first authenticated call.

Prerequisites · An active Helio workspace and a CLI installed (npm i -g @helio/cli).

Create an API key

From the workspace dashboard, open Settings → API keys and click Create key. Give it a descriptive name (we use the app name) and pick the scopes it needs. Keys are never shown twice — copy it into your secret manager right away.

$ helio keys create --name staging-api --scope read:orders,write:webhooks
# → creates a scoped bearer token
helio_live_sk_7fC9d2aK3vN8qY4xM1pR6zB0jL

Make your first request

Pass the key in the Authorization header. A successful call returns 200 OK with the current workspace.

$ curl https://api.helio.dev/v1/workspace \
    -H "Authorization: Bearer $HELIO_KEY"

# → 200 OK
{
  "id": "ws_7fC9d2aK",
  "name": "Staging",
  "plan": "team"
}

Rotate keys safely

Every key supports overlap windows — create a new one, deploy it alongside the old one, and revoke the old key once traffic has moved. The dashboard shows last-use timestamps so you know when a key is safe to retire.

On this page

Create an API key
Make your first request
Rotate keys safely

[ Guide · Authentication ]

Authenticate your first request

Create an API key

Make your first request

Rotate keys safely

Core concepts

Webhooks