Skip to content

Authentication

Release binding: v0.1.0-enterprise-ready · AMI ami-010806d4d3445660e · 2026-05-19

Two credentials exist on an appliance.

Bootstrap admin key

Generated at first boot and stored once at /opt/hx-sdp/secrets/bootstrap-admin.json. It authenticates gate administration: /gate/admin/* and /gate/onboard/*.

Tenant keys

Issued by the admin through POST /gate/onboard/create. They authenticate the data plane (/v1/*).

  • Tenant keys have the form hx_live_<48 hex> and are stored SHA-256 hashed; the plaintext is shown once at creation.
  • Pass a key as Authorization: Bearer <key> or X-Api-Key: <key>. The gate reads the Authorization header first.
  • Rotate with POST /gate/onboard/rotate-key; the old key stops working immediately.
  • Each tenant key is bound to a namespace ACL; requests outside it return 403.
  • WebSocket clients pass the key as the holonomix-api-key.<key> subprotocol.

Example

curl -sk https://<host>:8443/v1/list/team-a \
  -H "Authorization: Bearer hx_live_..."

Rotation

curl -sk -X POST https://<host>:8443/gate/onboard/rotate-key \
  -H "Authorization: Bearer <ADMIN_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"tenant_id": "team-a"}'

The response carries the new key, shown once. Update clients before the old key is retired from your secret store.