Authentication guide
Every operational endpoint under /api/ requires authentication. Three credentials exist; most users only ever need the first.
1 · Get an API token
Create an account (or log in), open your account page, name a token, and press Create token. The secret is displayed once — copy it immediately. Only its SHA3-256 hash is stored server-side, so it can never be re-shown; lost tokens are simply revoked and re-issued. Revoking takes effect immediately.
2 · Use it
Swagger UI — open /api/swagger-ui, press Authorize, and paste your token into the bearerAuth field as-is (Swagger adds the Bearer prefix). Authorization persists across reloads. Then any operation's Try it out runs live.
Any HTTP client — send the same value as an Authorization header:
curl -H "Authorization: Bearer hyp_XXXXXXXX…" \ "https://hyplica.local/api/dggs/hyplica-earth/zones?bbox=149.12,-35.29,149.13,-35.28&zdepth=0/1000&datetime=2020-06-01T00:00:00Z/2020-06-01T01:00:00Z&zone-level=8"3 · Short-lived bearer tokens (optional)
For pipelines that shouldn't hold a long-lived secret, exchange your API token (or browser session) for a short-lived HQT bearer — a hybrid-signed token (Ed25519 + ML-DSA-65, the post-quantum posture of the platform) that expires automatically:
curl -X POST -H "Authorization: Bearer hyp_XXXXXXXX…" https://hyplica.local/auth/hqt/ # → {"token_type": "Bearer", "access_token": "…", "expires_in": …} curl -H "Authorization: Bearer <access_token>" https://hyplica.local/api/dggsIn Swagger, the same bearerAuth field takes the access_token value directly — the header self-discriminates the two credential kinds.
What needs no token
The API definition is public by design (OGC API - Common service-desc/service-doc): /api/openapi and /api/swagger-ui — clients bootstrap from the definition, then authenticate for everything operational.