Skip to main content

Documentation Index

Fetch the complete documentation index at: https://hubify.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

​
Authentication

The Hubify API supports two authentication methods: API keys (for server-to-server) and Clerk JWT tokens (for user sessions).

​
API Keys

API keys are long-lived credentials for programmatic access. Create them from the CLI or web UI.

​
Creating an API Key

hubify auth api-key create --name "my-integration" --scope "labs:read,experiments:*"

{
  "key": "hfy_key_abc123def456ghi789",
  "name": "my-integration",
  "scopes": ["labs:read", "experiments:*"],
  "created_at": "2026-04-14T10:00:00Z",
  "expires_at": null
}
API keys are shown only once at creation. Store them securely. If lost, revoke and create a new one.

​
Using an API Key

curl https://www.hubify.com/api/v1/labs \
  -H "Authorization: Bearer hfy_key_abc123def456ghi789"

​
Scopes

ScopeDescription
labs:readRead lab information
labs:writeCreate, update, delete labs
experiments:readRead experiment status and results
experiments:writeCreate and manage experiments
experiments:*Full experiment access
agents:readRead agent configuration
agents:writeManage agents
papers:readRead paper content
papers:writeCreate and edit papers
pods:readRead pod status
pods:writeCreate and manage pods
tasks:*Full task access
knowledge:*Full knowledge base access
*Full access (all scopes)

​
Clerk JWT Tokens

For user-facing applications, use Clerk JWT tokens obtained through the Clerk authentication flow.

​
Obtaining a Token

import { useAuth } from '@clerk/nextjs';

const { getToken } = useAuth();
const token = await getToken();

fetch('https://www.hubify.com/api/v1/labs', {
  headers: { 'Authorization': `Bearer ${token}` }
});

​
Token Refresh

Clerk tokens expire after 60 seconds. Use the Clerk SDK’s automatic refresh mechanism for long-lived sessions.

​
Environment Variables

VariableDescription
HUBIFY_API_KEYAPI key for programmatic access
HUBIFY_TOKENShort-lived auth token
CLERK_SECRET_KEYClerk secret for server-side verification

​
Security Best Practices

  • Use the narrowest possible scopes for API keys
  • Rotate API keys regularly (every 90 days recommended)
  • Never commit API keys to version control
  • Use environment variables for all credentials
  • Prefer Clerk JWT tokens for user-facing applications
  • Revoke compromised keys immediately with hubify auth api-key revoke <key>