PanelDOCSv1.0.0

Get an API key

How a partner gets its partner API key, how to keep it safe, and how to replace or stop it.

Your systems call the partner API with a partner API key. The key starts with hfp_ and belongs to your partner account, not to a person: it can see and change only your own licences.

Get your key

HostFog Ltd makes the key for you on the licence server, under HQ › Partners, and sends it to the technical contact you named when you joined.

  1. Ask for a key through https://hostfog.com/contact/, from the email address of your partner account.
  2. You receive the key once. Store it straight away in your secrets store, such as your provisioning system's encrypted settings or a vault.

The key is shown only once, also to HostFog Ltd: the licence server keeps only a fingerprint of it (its SHA-256), never the key itself. A lost key cannot be looked up, only replaced.

Important: your bulk licences must be active (paid) for the key to work. Calls with the key of an account whose payments have stopped answer 403.

Use the key

Send the key in the Authorization header of every call:

bash
curl -s https://api.hostfog.com/v1/licence/partner/licences \
  -H "Authorization: Bearer hfp_…"

A missing or wrong key answers 401.

Keep it safe

  • Keep the key on your own servers. Never put it in a customer's server, a browser page, a mobile app or a public repository.
  • Give it only to the systems that create and delete servers.
  • Replace it when someone who knew it leaves, and at least once a year.

Replace or stop a key

To Ask HostFog Ltd to
Replace the key make a new key. The old one stops working at the same moment, so update your systems straight after.
Stop the key at once, for example after a leak revoke it. Every call with it then answers 401; your servers and licences keep working.

Tip: plan a replacement for a quiet hour: make the new key, put it in your systems, then check one GET /licences call.