Projects sit above product features. A client API key belongs to exactly one project, so the same credential resolves the correct routing, Memory, usage, and billing boundary.
#Project model
- An account can own multiple projects, subject to its membership plan.
- Each project has a stable internal ID and an encrypted project key.
- Client API keys are assigned to a project when created.
- Deleting a project is a destructive boundary operation.
#Create a client key
- 1Select a project
Open the intended environment from the project grid.
- 2Open API Keys
Create a key with a name that identifies its workload.
- 3Copy once
Store the plaintext immediately. HALO displays only safe identifiers after creation.
#Use a client key
The accepted header depends on the provider-compatible API.
| API | Accepted client-key placement |
|---|---|
| Gemini | x-goog-api-key: sk-… or ?key=sk-… |
| OpenAI / DeepSeek / open-source | Authorization: Bearer sk-… |
| Anthropic | x-api-key: sk-… |
| Memory | Authorization: Bearer sk-… |
#Rotation & deletion
Create a replacement key, deploy it to the trusted workload, verify traffic, then delete the old key. Deletion is immediate; requests using that key will fail authentication.