Skip to main content
Every request to the HackGATE API must include a valid token in the Authorization header using the Bearer scheme:
The API supports two token types and automatically detects which one you are using based on the token format.

​
Token types

Clerk JWT (prefix: eyJ...) — A short-lived JWT issued by your Admin Center browser session. Use this for interactive access, ad-hoc requests from your terminal, or testing. Organization API key (prefix: ak_live_...) — A long-lived token scoped to your organization. Use this for CI/CD pipelines, automation scripts, and any non-interactive workflow where a browser session is not available. Generate API keys in the Admin Center under Settings > API Keys.

​
Request examples

Retrieve your JWT from the Admin Center session (available in your browser’s local storage or via the Clerk SDK). Pass it as a Bearer token:
Clerk JWTs expire with your session. If you receive a 401, sign in again at admin.hackgate.io to get a fresh token.

​
Common errors

Never expose your API keys in client-side code, public repositories, or anywhere that could be accessed by unauthorized parties. Treat your ak_live_ key like a password. If a key is compromised, revoke it immediately in Settings > API Keys and generate a new one.