API keys and workspace resolution

Key format

Workspace API keys are prefixed hxv_. Create and rotate them in the dashboard. Provider credentials (OpenAI, OpenRouter, etc.) are stored separately under Dashboard → Providers and are never sent by your application.

Sending the key

Preferred: the Authorization header with a bearer credential.

curl https://api.hardcarrx.com/v1/chat/completions \
  -H "Authorization: Bearer hxv_your_workspace_api_key" \
  -H "Content-Type: application/json" \
  -d '{...}'

Also accepted: the x-api-key header.

curl https://api.hardcarrx.com/v1/chat/completions \
  -H "x-api-key: hxv_your_workspace_api_key" \
  -H "Content-Type: application/json" \
  -d '{...}'

Workspace scoping

Key-scoped endpoints (chat, responses, memory, usage, request logs) resolve the workspace from the API key. Where a request must target a specific workspace, pass its id in the x-workspace-id header.

curl https://api.hardcarrx.com/v1/memory/store \
  -H "Authorization: Bearer $HARDCARRX_API_KEY" \
  -H "x-workspace-id: 00000000-0000-0000-0000-000000000123" \
  -H "Content-Type: application/json" \
  -d '{...}'

Workspace management endpoints use a session bearer token and a workspace_id path parameter instead of an API key.

Provider credentials

By default, model requests use the provider credential stored in your workspace. For one-request usage you can send an inline provider_key in the request body (BYOK); it is used only for that request.

curl https://api.hardcarrx.com/v1/chat/completions \
  -H "Authorization: Bearer $HARDCARRX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "openrouter",
    "provider_key": "your_provider_api_key",
    "model": "openai/gpt-4o-mini",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

Auth errors

• 401 — missing or invalid Hardcarrx API key.
• 402 — plan or quota cannot accept the request.

See the error catalog for the full envelope.