Mint Starter Kit
Mint Starter Kit

Getting started

Authentication

Two credentials, and they are not interchangeable.

The API takes two different credentials depending on what you are doing.

CredentialHeaderWhat it is for
API keyX-API-Key: <key>Scraping: /scrape, /scrape/batch
Login tokenAuthorization: Bearer <token>Everything else: keys, logs, accounts, schedules, settings, analytics

Sending the wrong one returns auth_failed (HTTP 401).

API keys

Create and revoke keys in the console, or over the API with a login token:

curl -X POST 'https://api.helicitylabs.com/api-keys' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"label": "production worker"}'

The raw key is returned once, in the creation response. After that only its label and prefix are visible. Lost keys are revoked and replaced, not recovered.

Keys do not expire. Revoke one with DELETE /api-keys/{api_key_id}; it stops working immediately.

Login tokens

curl -X POST 'https://api.helicitylabs.com/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{"email": "you@example.com", "password": "..."}'

The response carries a bearer token. GET /auth/me confirms who it belongs to, and POST /auth/logout ends the session.

POST /auth/register exists but is closed in production. Tenants are created by hand. Ask us and we will set one up.

Keeping keys out of your repo

The API key is the credential that can spend credits, so treat it as a secret: read it from the environment, never commit it, and give each deployment its own key so you can revoke one without taking the others down.