Heron Authentication

generated: '2026-08-14'
method: searched
source: >-
  https://docs.herondata.io/api-reference/authentication, confirmed against the published
  contract openapi/heron-openapi.json (harvested from https://app.herondata.io/swagger), which
  declares exactly one securityScheme — ApiKeyAuth (apiKey, in: header, name: x-api-key) —
  applied at the root security level so it covers all 272 operations.
docs: https://docs.herondata.io/api-reference/authentication
openapi: openapi/heron-openapi.json
spec_confirmation:
  securitySchemes: 1
  scheme: ApiKeyAuth
  applied: root-level security (all operations)
  oauth2_flows: 0
  openIdConnect: false
  mutualTLS: false
description: >-
  Heron authenticates every API request with a customer-issued API key sent in
  the x-api-key HTTP header. Keys are managed from the dashboard (Settings ->
  API Credentials): create, list, deactivate, reactivate, delete, and rotate.
  Development and production are separated at the credential level — trial /
  onboarding uses development credentials, and production credentials are issued
  separately on request. A second key class, the "broker API key", authenticates
  the broker-submission endpoints and is generated per broker-funder
  relationship via /api/broker_submissions/api_keys/generate.
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
schemes:
  - name: ApiKeyAuth
    type: apiKey
    in: header
    parameter_name: x-api-key
    key_format: key_ followed by 48 hexadecimal characters
    token_visibility: >-
      Full token shown once at creation; only the first 8 characters (prefix)
      are retrievable afterwards.
    sources: [https://docs.herondata.io/api-reference/authentication]
  - name: BrokerApiKeyAuth
    type: apiKey
    in: header
    parameter_name: x-api-key
    scope: broker-submission endpoints only
    generation: POST /api/broker_submissions/api_keys/generate
    sources: [https://docs.herondata.io/api-reference/brokersubmissions/generate-broker-api-key.md]
environments:
  development: Issued for trial / onboarding; separated from production at the credential level.
  production: Issued separately on request (contact your Heron rep / hello@herondata.io).
rejected_status: 401 (deactivated or invalid key)