Authentication

All API requests require a Bearer token in the Authorization header.

API keys for your own code

Create a read-only key in Settings > Connected apps. It starts with hdk_ and is shown once. Copy it then. For a no-code walkthrough, see API keys.

curl -H "Authorization: Bearer hdk_YOUR_KEY" \
  https://www.tryhoard.com/api/v1/store/inventory

An API key can call Store data and GET /sync/status. Other endpoints return 403 developer_route_not_allowed. Rotate a key to get a new secret; the old one stops working right away. Revoke it to turn it off.

Desktop agent key

Go to Settings > Profile
Your API key is displayed in the “Account” card (any paid plan)
Click “Reveal” to see it, “Copy” to copy it

Using the API key

Include it in every request:

Authorization: Bearer YOUR_API_KEY

Hosted MCP usage

After your monthly assistant allowance, one credit covers a 100-unit block. Two one-unit reads share that credit.

Examples

curl

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://www.tryhoard.com/api/v1/status

Python

import requests

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://www.tryhoard.com/api/v1"

headers = {"Authorization": f"Bearer {API_KEY}"}

response = requests.get(f"{BASE_URL}/status", headers=headers)
print(response.json())
# {"sync_in_progress": false, "last_sync_at": "2026-04-19T14:30:00Z", ...}

Node.js

const API_KEY = "YOUR_API_KEY";
const BASE_URL = "https://www.tryhoard.com/api/v1";

const response = await fetch(`${BASE_URL}/status`, {
  headers: { Authorization: `Bearer ${API_KEY}` },
});
const data = await response.json();
console.log(data);
// { sync_in_progress: false, last_sync_at: "2026-04-19T14:30:00Z", ... }

Security

Your API key is unique to your account
It provides full read and write access to your account: inventory, orders, sales, pricing rules, lists, and pricing actions. Unlike OAuth connector tokens, it is not scope-limited
Never share it or commit it to version control
Store it in your .env file, not in workflow YAML or scripts
If compromised, regenerate it from Settings > Profile. Click “Regenerate key”. The old key stops working immediately, so update your agent’s .env with the new key to reconnect

Error responses

401 — Invalid or missing API key

HTTP 401
{"error": "Invalid or missing API key", "code": "unauthorized"}

The code: "unauthorized" field is machine-readable. Check for it programmatically to distinguish authentication failures from other errors.

403 — Account suspended

HTTP 403
{"error": "Account suspended", "code": "account_suspended"}

​API keys for your own code

​Desktop agent key

​Using the API key

​Hosted MCP usage

​Examples

​curl

​Python

​Node.js

​Security

​Error responses

​401 — Invalid or missing API key

​403 — Account suspended