HYPER/SOFTS
SUPPORT · CONSOLE
gateway · v2.4 · online

Sign the packet.
Trust the ledger.

A hardened API gateway with HMAC-signed requests, per-key IP + domain locking, STS token issuance and a real-time audit console. Handcrafted for teams who can't afford a leak.

request access →view endpoint
tls 1.3hmac-sha256ip · cidr lockaudit ledgersts issuance
~/hyper-softs · signed-request.sh
$ curl -sS https://support.hyperapi.in/api/public/get_sts \
    -H 'x-api-key-id: HS_k_9x…' \
    -H 'x-api-key-secret: ••••••••'

{
  "code": 0,
  "msg":  "ok",
  "data": {
    "accessKeyId":    "STS.NT…",
    "securityToken":  "CAIS…",
    "expiration":     "2026-07-20T12:34:56Z",
    "bucket":         "hs-upload",
    "region":         "ap-south-1"
  }
}
99.98%
gateway uptime
< 40ms
median sts issue
0
unsigned requests served
24×7
operator on call

01 · what we ship

Everything a serious API needs — nothing you have to babysit.

◆ service
signed api gateway

HMAC-SHA256 requests with STS token issuance, timestamp skew guard and replay protection.

◈ service
key management

Per-developer keys with IP / CIDR + domain whitelisting, one-click rotate and instant revoke.

▣ service
live audit console

Real-time request log, error breakdown, per-key traffic view — exportable, forever.

▲ service
sts for object storage

Aliyun / S3-compatible STS tokens, scoped bucket + directory, short-lived by default.

● service
ticket + telegram alerts

Support tickets pipe straight to the admin console with instant Telegram notifications.

✦ service
handcrafted, not vibecoded

Written by operators, reviewed line-by-line, shipped only when the ledger says green.

02 · how it works

Four steps from handshake to signed traffic.

01
request access

Tell us what you're building. We provision a developer + one active key.

02
lock the perimeter

Add your server IPs / CIDR blocks and domains. Empty = unrestricted.

03
sign & call

Send api-key-id + secret headers to /api/public/get_sts and receive STS.

04
watch the ledger

Every hit is stamped, categorized and streamed to your console.

03 · endpoint

post/api/public/get_sts

Single-shot endpoint. Send valid credentials → get short-lived STS credentials for object storage. Add ?mode=validate to check the key without issuing a token.

headervalue
x-api-key-idissued key id
x-api-key-secretissued key secret
content-typeapplication/json
$ sample response
{
  "code": 0,
  "msg":  "ok",
  "data": {
    "accessKeyId":    "STS.NT…",
    "accessKeySecret":"••••••••",
    "securityToken":  "CAIS…",
    "expiration":     "2026-07-20T12:34:56Z",
    "bucket":         "hs-upload",
    "region":         "ap-south-1",
    "dir":            "u/42/"
  }
}

support · faq

Common issues, answered fast.

Skim these before you open a ticket — most integration questions resolve in under a minute.

self-serve · updated weekly