Security
Short version: keys are hashed, secrets are shown once, MCP needs a paid
plan when accounts are on, and hexum_check does not send your
repo to a model.
Keys
A hexum_live_… value is displayed once at mint time. We store a
BLAKE3 hash and a prefix. The engine authorizes from an in-memory map of
those hashes. Revoke a key in the dashboard if it leaks — agents using it
fail on the next call.
Account
Sign-in is email and password via our auth provider. You can reset a forgotten password from the sign-in card (we email a link) or change it while signed in on the Account card. Delete the account from the same card to revoke remaining keys.
MCP path
POST /mcp and /v1 require Authorization: Bearer hexum_live_…. With accounts enabled, the
key’s user must be on Usage or Teams. Payloads live in process memory and
expire after 15 minutes idle. They are not written into the usage tables
(those hold token counts and call counts only).
Billing
Card details never touch Hexum’s database. Stripe Checkout and the Customer Portal handle payment methods. There is no spend cap that cuts MCP off; cancel in the portal if you need charges to stop.
Report a problem
Use Contact. Do not send live keys in email. Revoke first, then describe what happened.