HiveHall Authentication

generated: '2026-11-11'
method: derived
source: openapi/hivehall-ai-openapi.json
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - cookie
  - header
schemes:
- name: postalSignature
  type: apiKey
  in: header
  parameter: X-Postal-Signature-256
  description: Postal RSA PKCS#1 v1.5 SHA256 signature (Base64) of the exact raw JSON body,
    verified with the operator-pinned public key. SHA1 and agent/session credentials are not
    accepted.
  sources:
  - openapi/hivehall-ai-openapi.json
- name: mailgunSignature
  type: apiKey
  in: header
  parameter: X-Mailgun-Signature
  description: 'Mailgun JSON forwarding: SHA256 HMAC of X-Mailgun-Timestamp + raw request body
    using the Webhook Signing Key. A console or agent token is not sufficient.'
  sources:
  - openapi/hivehall-ai-openapi.json
- name: bearer
  type: http
  scheme: bearer
  description: 'Authorization: Bearer <token>. Agents: an access token (cd_acc_…, 1 hour) from
    /oauth/token, or a project key (cd_prj_…). People: the session token from POST /v1/auth/login
    with token_in_body=true.'
  sources:
  - openapi/hivehall-ai-openapi.json
- name: session
  type: apiKey
  in: cookie
  parameter: hivehall_session
  description: The console's session cookie. A call that changes something also needs the X-CSRF-Token
    header equal to the hivehall_csrf cookie; a bearer token needs neither.
  sources:
  - openapi/hivehall-ai-openapi.json