Skip to main content
Every request is authenticated with an API key scoped to one organization. The SDK reads those two variables, and takes the same values as constructor arguments.

​
The base URL has no default

HOLLERITH_BASE_URL is required. With no base_url= argument and no environment variable, the constructor raises a plain Python ValueError before any request is sent. That ValueError is not a HollerithError, so an except HollerithError block will not catch it. A missing key is different: that raises AuthenticationError with code missing_api_key. The origin you point at proxies only /v1/* and /sdk/*. Everything else on that host is the console, not the API.

​
Create a key

  • Sign in to the console and open API Keys.
  • Create a key. It begins with hk_live_.
  • Copy it. The plaintext is shown exactly once and is never retrievable again.
Store it in a secret manager or your shell environment. If you lose it, revoke it and create a replacement. Keys do not expire. One stays valid until you revoke it, and the console lists it by a masked form such as hk_live_••••3f9a alongside the time it was last used.

​
The placeholder ellipsis

Console snippets write the placeholder as hk_live_… with a single Unicode ellipsis character, not three periods. Pasted unchanged, it is a syntactically valid string that matches no key, and every call returns invalid_api_key. Replace the whole placeholder, ellipsis included, with the key you copied. Integrating from a language other than Python? The REST API documents the same calls on the wire.

​
Rotate or revoke

Revoking a key disables it immediately; the next request with it returns revoked_api_key. Create the replacement first if you want no gap in service. Revoked keys are retained rather than deleted. This is deliberate — the row carries the last-used timestamp, so revoking a key does not erase the record of what it did.

​
One key, one organization

A key resolves to exactly one organization, and every read is scoped to that organization. Reaching a job, fitted context or key belonging to another one returns org_forbidden. Cross-organization access is never permitted and cannot be granted. To run against data another organization owns, create a key there.

​
Next

  • Errors — every code, the envelope fields, and the requestId to quote
  • Quickstart — first prediction in about a minute
  • Limits and quotas — what your key is allowed to spend per day