Security
Key handling, scopes, and the endpoints that stay closed.
Keys
- Bearer API key only. Browser Origin auth is rejected on Intelligence endpoints.
- Keys are hashed server-side and scoped to one organization.
- Scope keys to intelligence or helpdesk so a leak has a smaller blast radius.
- Proxy every call through your backend. Never ship an hm_live_ key to a client.
- Rotate under Settings → Developers. Last-used timestamps show which keys are live.
Closed on Custom
| Endpoint | Custom |
|---|---|
| POST /api/v1/intelligence/* | Open with a scoped key |
| POST /api/v1/chat | 403 — hosted agent only |
| Widget / Link / React embeds | 403 — hosted agent only |
| Proactive popup | 403 — hosted agent only |
Data you send
Transcripts on create-ticket are stored so a human can act on them. Memory facts persist until deleted. Keep secrets, card data, and credentials out of both.