Authentication

Get an API key

An organization owner or admin creates API keys in ChartHero, under the organization's settings in Connections → API Keys. Choose the key's scopes and expiration date when you create it: keys can't be edited, so to change scopes, create a new key and revoke the old one. ChartHero shows the full key once; store it in your secret manager right away.

Send each key only to its own environment's host, as Environments describes. If you don't see the API Keys tab, contact ChartHero support.

API key header

Every public API request must include an API key in the Authorization header using the Bearer scheme.

Authorization: Bearer <api_key>

Send the header from your server-side integration. Do not send API keys in query parameters.

Keep keys secret

API key values are shown only as synthetic placeholders in these docs. Treat production API keys as secrets.

Store keys in a server-side secret manager or encrypted configuration. Do not place keys in browser code, mobile applications, logs, analytics events, customer-visible error messages, or support screenshots. Rotate a key if it may have been exposed.

Access checks

ChartHero checks API-key validity, route availability, organization-scoped key requirements, and required scopes before returning data or parsing route-specific query parameters.

A request may be denied when:

1. The API key is missing or invalid.
2. The key is inactive, expired, or revoked.
3. The key does not include the required scope.
4. The key is not scoped to the caller organization.
5. The requested resource is outside the caller's organization.
6. The route is not available in the current environment.

Because route-level checks run first, a request that fails authentication, route availability, organization-scope, or scope checks can return an authentication or authorization error even if the URL also contains an invalid query parameter. After those checks pass, unsupported query parameters can be reported before ChartHero looks up a specific resource.

Production access

Production API access requires the production host, a production API key, available public routes, and the required scopes. Before sending production traffic, confirm the host, key, route availability, and scope set for your integration.

Use separate keys for separate environments. A staging key may be rejected in production, and a production key should not be used in local development or shared test tooling.

Before sending production traffic, confirm the key, route availability, and scope set in Environments.

Common authentication errors