Credentials

Each account has two independent secrets:

Rotating one does not affect the other.

Rotating the proxy password

curl -H "Authorization: Bearer $HYPERCALL_KEY" -X POST \
  https://api.hypercall.dev/api/me/rotate-password

{ "proxy_password": "<new password>" }

The new password is shown exactly once. It cannot be retrieved later, so store it before you close the terminal.

Rotation takes effect across the network within seconds. Connections using the old password stop working, so roll it when you can update your clients.

Rotating the API key

curl -H "Authorization: Bearer $HYPERCALL_KEY" -X POST \
  https://api.hypercall.dev/api/me/rotate-key

{ "api_key": "uk_..." }

This mints a fresh key and revokes every other key on the account, including the one you just authenticated with. This is deliberate: it is designed for the case where a key may have leaked, and it guarantees no forgotten key survives. Switch to the returned key immediately.

Rotating a sub-user’s password

Parents can roll a sub-user’s proxy password without knowing the old one:

curl -H "Authorization: Bearer $HYPERCALL_KEY" -X POST \
  https://api.hypercall.dev/api/users/<id>/rotate-password

If something leaks

1. Rotate immediately: password, key, or both.

2. Check usage on /api/me; unexpected bytes_used is the clearest sign a credential was used by someone else.

3. Restrict by source IP so credentials alone aren’t enough:

   curl -H "Authorization: Bearer $HYPERCALL_KEY" -X PUT \
     -H 'Content-Type: application/json' \
     -d '{"cidrs": ["203.0.113.0/24"]}' \
     https://api.hypercall.dev/api/users/<id>/allowed-ips
   

Handling passwords safely

Proxy passwords can contain @ : / # %. Never paste one raw into a proxy URL: it gets misparsed, and you’ll chase a 407 that has nothing to do with the password being wrong. Use your client’s separate credential fields, or percent-encode.