API keys
Create a Helipod API key, choose what it can reach, and send it with every request.
One Helipod API key can be used for the VPS API, the Container API, the Database API, the Email API, the Domain API, the AI API and the Account API. You decide which of these products a key may use, and whether it can reach one project or your whole account. The Email API also still accepts its own email keys, see Email API.
Create a key
Open your project settings
In the dashboard, open a project and go to Settings → API keys.
Choose the access
- Only this project: the key sees and changes only this project's servers, services and database. Use it for one app or one customer.
- Whole account: the key can use every project you own, your domains, and your wallet and AI balance. It can also create and delete projects. The Domain API needs this, because domains belong to your account rather than to a project, and so do the money routes of the Account and AI APIs.
Choose the products
Tick VPS API, Container API, Database API, Email API, Domain API, AI API and/or Account API. A request to a product the key was not given is refused with 403 SCOPE_NOT_ALLOWED.
Copy the key
The key starts with hel_ and is shown once. Store it in a secret manager or a CI secret. If you lose it, revoke it and create a new one.
Send the key
Pass the key as a bearer token:
curl https://api.helipod.io/api/containers/projects \
-H "Authorization: Bearer hel_your_key"There is no other way to authenticate: browser sessions of the dashboard are not accepted by the public API.
Products
| Product | Scope | API |
|---|---|---|
| VPS API | vps | VPS API |
| Container API | containers | Container API |
| Database API | databases | Database API |
| Domain API | domains | Domain API (whole-account key) |
| Email API | email | Email API |
| AI API | ai | AI Gateway Management API: prices, balance, usage, AI keys, top-ups |
| Account API | account | Account API: wallet, invoices, statements, notifications, activity, tickets |
A key created without choosing products gets the first five. AI API and Account API are never included by default, because they reach your balance, invoices and support tickets: tick them only on keys that need them.
What a key can reach
Prop
Type
Ids you cannot reach look like ids that don't exist
Anything outside a key's reach (another customer's service, another project, a deleted resource, a malformed id) answers 404, never 403. This way an id can't be probed to learn that it exists.
What stays in the dashboard
Some things can't be done with any key, so a leaked key can't be used to give itself more power or to take money from outside Helipod:
- Creating keys: Helipod API keys, email API keys and AI keys are created only in the dashboard. The APIs can list and revoke AI keys, not create or show them.
- Team members: inviting people and changing their roles.
- Paying from outside: top-ups of the wallet by card, bank transfer or e-wallet. Keys spend the wallet you already have, and can move money from it to the AI balance.
- Email account settings: setting up email for a project, cancelling a plan and its billing switches, and mailbox webmail passwords.
Good practice
- Create one key per integration (
ci,mcp-agent,billing-script) so you can revoke one without breaking the others. - Prefer project access unless you really need several projects, domains or account routes.
- Paid actions are charged to the wallet of the key's owner. Paid calls in the Container, Database, Domain and AI APIs and email plan purchases accept
?dryRun=trueto show the price before you commit, see Requests and errors. - You can hold up to 10 active keys. Revoking a key takes effect immediately.