Hashable Authentication: API Security & Credential Management

Authentication overview

Hashable's API Security Platform requires authentication for all interactions, ensuring that only authorized users and services can access and configure API threat detection, real-time anomaly monitoring, and automated blocking features. The platform is designed to protect customer APIs by enforcing security policies and identifying malicious traffic, and strong authentication is a foundational component of this security model. All API interactions with Hashable's platform occur over HTTPS to ensure data in transit is encrypted and secure Hashable documentation on secure communication. Hashable supports granular access control through role-based access control (RBAC), allowing administrators to define specific permissions for different user roles within an organization Hashable's RBAC documentation. This helps to enforce the principle of least privilege, where users are granted only the necessary permissions to perform their tasks, reducing potential security risks.

The primary method for programmatic interaction with Hashable's API is through API keys, which are generated and managed within the Hashable dashboard. These keys act as unique identifiers and provide the necessary credentials to authenticate requests. For human users accessing the Hashable dashboard, a robust login process typically involving username/password and often multi-factor authentication (MFA) is employed. The platform's commitment to security is further underscored by its SOC 2 Type II compliance Hashable's compliance information, which verifies its adherence to strict security, availability, processing integrity, confidentiality, and privacy standards.

Supported authentication methods

Hashable primarily supports API key authentication for programmatic access to its platform. This method is suitable for server-to-server communication, automated scripts, and integration with other systems that require secure access to Hashable's API security services. While API keys are the main method for API access, Hashable's web-based dashboard for managing the API Security Platform utilizes standard web authentication flows, typically involving username and password, often augmented with multi-factor authentication (MFA) for enhanced security.

API keys offer a balance of security and convenience for automated processes. They are typically long, randomly generated strings that are difficult to guess. However, their security relies heavily on how they are stored and transmitted. Best practices, such as storing keys in environment variables or secure vault services and transmitting them over HTTPS, are crucial. The use of multi-factor authentication for dashboard access adds an extra layer of security by requiring users to verify their identity using a second factor, such as a mobile app or hardware token, in addition to their password Google Cloud's explanation of multi-factor authentication. This significantly reduces the risk of unauthorized access even if a password is compromised.

Getting your credentials

To obtain API keys for Hashable, you will typically follow these steps through the Hashable web dashboard:

1. Log in to the Hashable Dashboard: Access your account using your username and password, along with any configured multi-factor authentication Hashable login guide.
2. Navigate to API Settings: Locate the section within the dashboard dedicated to API Keys or Developer Settings. The exact path may vary but is usually found under 'Settings', 'Profile', or a similar administrative menu.
3. Generate New API Key: Look for an option to 'Generate New API Key' or 'Create API Key'. You may be prompted to provide a name or description for the key, which helps in identifying its purpose later.
4. Copy the Key: Once generated, the API key will be displayed. It is crucial to copy this key immediately and store it securely, as it may not be retrievable again for security reasons. If lost, you will need to generate a new one.
5. Configure Permissions (Optional): Some platforms allow you to assign specific permissions or scopes to an API key during generation. Review if this option is available and configure the minimum necessary permissions for the key's intended use to adhere to the principle of least privilege.

For human users accessing the Hashable dashboard, credentials are created during the account registration process. This typically involves setting up a unique username (often an email address) and a strong password. Hashable encourages and often enforces the use of multi-factor authentication (MFA) to enhance dashboard login security. Users can usually enable and configure MFA within their account security settings after initial registration Hashable security settings documentation.

Authenticated request example

When making API requests to Hashable, your API key will typically be included in the request headers. The exact header name and format may vary, but a common pattern is to use an Authorization header or a custom header like X-Hashable-API-Key. Always refer to the specific Hashable API documentation for the precise header name and value format Hashable API reference.

Below is a conceptual example using curl to make an authenticated GET request to a hypothetical Hashable API endpoint to retrieve a list of monitored APIs. Replace YOUR_API_KEY with your actual Hashable API key and https://api.hashable.com/v1/apis with the correct endpoint.

curl -X GET \
  'https://api.hashable.com/v1/apis' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json'

In this example, the Authorization: Bearer YOUR_API_KEY header carries the API key. The Bearer token scheme is a common method for sending API keys or access tokens RFC 6750 for Bearer Token Usage. Always ensure your requests are sent over HTTPS to protect your API key during transmission.

Security best practices

Adhering to security best practices for authentication with Hashable is critical to protect your API security posture. Compromised credentials can lead to unauthorized access to your security configurations and data.

• Secure Storage of API Keys: Never hardcode API keys directly into your application's source code. Instead, use environment variables, secure configuration files, or dedicated secret management services (e.g., AWS Secrets Manager AWS Secrets Manager documentation, Azure Key Vault Azure Key Vault overview) to store and retrieve keys securely. This prevents keys from being exposed in version control systems or publicly accessible code.

• Least Privilege Principle: When generating API keys or configuring user roles, grant only the minimum necessary permissions required for the intended task. Avoid using keys with broad administrative privileges for routine operations. Hashable's RBAC capabilities allow for fine-grained control over access Hashable's RBAC guide.

• Regular Key Rotation: Implement a policy for regularly rotating API keys. This limits the window of opportunity for an attacker if a key is compromised. The frequency of rotation should be determined by your organization's security policies and risk assessment.

• Monitor API Key Usage: Actively monitor the usage of your API keys. Look for unusual activity, such as requests from unexpected IP addresses, unusually high request volumes, or access to unauthorized endpoints. Hashable's platform can assist in monitoring API traffic patterns for anomalies Hashable's real-time anomaly detection.

• Enable Multi-Factor Authentication (MFA): For all human users accessing the Hashable dashboard, enable and enforce MFA. This adds a crucial layer of security, making it significantly harder for unauthorized individuals to gain access even if they have a user's password.

• Secure Transmission: Always ensure that all API requests to Hashable are made over HTTPS. This encrypts the communication channel, protecting your API keys and data from interception during transit.

• IP Whitelisting: If supported by Hashable, consider restricting API key usage to a specific set of trusted IP addresses. This ensures that even if an API key is stolen, it cannot be used from an unauthorized network location.

• Incident Response Plan: Have a clear incident response plan in place for handling compromised API keys or credentials. This should include steps for immediate key revocation, investigation, and communication.