Authentication

Every HTTP API request must supply a valid developer key as a bearer token in the Authorization header. Developer keys can be minted, named, inspected, and revoked under Hub → Settings → API Keys.

curl -X POST https://api.projecthollow.com/v1/tasks \
  -H "Authorization: Bearer hlw_sk_…" \
  -H "Content-Type: application/json" \
  -d '{ "text": "Investigate checkout latency regression" }'

Developer keys inherit the exact permissions and object visibility of the account that minted them.
Revoked or invalid keys reject immediately with an INVALID_KEY or KEY_REVOKED error.
Requests originating from unapproved accounts receive an ACCOUNT_NOT_APPROVED error response.