Authentication

Every credential is issued, scoped and revoked by Heimaleiga staff. You never create one yourself.

Personal accounts

A person at your company gets an email invite. Following it sets a password; if Heimaleiga requires multi-factor authentication for the account (the default), you also enrol an authenticator app (Google Authenticator, 1Password, Authy…). This account is what you use for Claude (MCP) and for interactive API use.

• Sign-in sessions last one hour and refresh automatically in clients that support it.
• Lost your authenticator? Ask Heimaleiga to reset it — they can also temporarily relax the MFA requirement for your account.
• A disabled or removed account stops working immediately, everywhere.

Service keys

A long-lived bearer token (up to two years) tied to your owner account, for scheduled jobs: a Power BI refresh, a nightly script. Heimaleiga shows it to you once; store it in your secrets manager. It has no MFA and cannot be used with Claude.

• Revocation is immediate: a revoked key reads empty tables.
• Ask for one key per system, with a label, so one can be rotated without touching the others.
• Expired keys must be re-issued; the expiry date is shown to Heimaleiga when they mint it.

Using a credential with the API

Send two headers on every request:

apikey: <the public project key — see the API page>
Authorization: Bearer <your service key, or your session's access token>

Getting a session token from a personal account in a script (password grant against the auth endpoint) is possible but service keys are the intended path for automation.

What a credential can do

Read. Only read. The tables carry no write permissions for any owner credential, so there is no such thing as an accidental write, and nothing you do here affects Heimaleiga's systems.