Horbit Authentication
Secret and publishable keys, and where to use each.
Every request carries a workspace key. Keys are created in Configuration → API keys in the Horbit console.
| Key | Looks like | Use it from | Can |
|---|---|---|---|
| Secret | htk_… | Your server (Next.js, Nuxt, Astro, a static build) | Read everything published, preview drafts, comment, react, count views |
| Publishable | hpk_… | The browser | Read everything published, comment, react, count views — only from the origins listed on the key |
Sending the key
Send it in the x-api-key header:
curl https://api.horbit.ng/v1/public/blog/posts?limit=5 \
-H "x-api-key: htk_…"A publishable key may also go in x-publishable-key, or in the ?key= query parameter — handy for a <link> tag, which cannot send headers.
Keep secret keys secret
Never put a secret key in browser code or in a URL. Horbit refuses secret keys sent as ?key=.
Origins
When a browser calls with a publishable key, its Origin must be one of the origins on the key, or the call is refused with 403.
Writes (comments, reactions, views) with a publishable key must come from a browser on an allowed origin. From a server, use the secret key.
Draft previews
With a secret key, add ?preview=true to GET /posts/{post} to read a post that is not published yet — useful for a preview route on your site.
Publishable keys never see drafts.
The blog module
If the workspace has the blog switched off, every call returns 403 with The blog module is not enabled for this workspace.