Keys and scopes
Two kinds of key
Secret hg_sk_… | Publishable hg_pk_… | |
|---|---|---|
| Lives in | Your server, a partner's backend, a CI job | JavaScript on a public web page |
| Shown | Once, when created. HotGlue stores only a hash. | Once, when created |
| Reads | Public catalog data | Public catalog data |
| If it leaks | Revoke it and make a new one | Nothing to leak: it is public by design |
Why two kinds if both read the same data today? Because a page's source is public, a publishable key is a promise that the key can never do more than read public data, whatever the API grows into. Secret keys are the ones that could carry more later. Treat them like passwords.
Scopes
Each key carries a list of scopes chosen when it is created. An endpoint needs one scope; a key without it gets 403 forbidden.
| Scope | Unlocks |
|---|---|
classes:read | /classes, /classes/{id}/instances, /categories, /trial-classes |
registrations:read | /registrations, /registrations/{id} |
memberships:read | /membership-types |
appointments:read | /appointment-services |
locations:read | /locations |
Give a key only the scopes it needs. A website that shows a schedule needs classes:read and maybe locations:read, nothing else.
Not sure what a key carries? GET /me needs no scope and returns the studio and the key's scopes.
Creating, naming, revoking
In HotGlue: Settings → API Keys (studio owners only).
- Name the key after what uses it ("StudioHub sync", "Website schedule widget"). The list shows each key's prefix, scopes and when it was last used, so a clear name is how you'll recognise it later.
- Copy it when it's shown. It is not shown again. If you lose a secret key, revoke it and create a new one.
- Revoke stops the key immediately: every request with it returns
401from then on. Revoking cannot be undone. Create the replacement first, switch your integration over, then revoke the old one.
What a key can never see
Regardless of type or scopes:
- Customer or student data of any kind
- Draft or archived classes and seasons, hidden catalog groups, inactive prices
- Anything belonging to another studio (
404) - Anything writable. There are no write endpoints.