The playground
Try the REST API, the MCP server and signed embed tokens in your browser. Sample data needs no account, a playground key reads your own organization, and you can paste a key of your own.
The playground lets you make requests and see exactly what comes back, before you write any code. Each tab shows the request as code, so you can take it with you.
The three tabs
| Tab | What it does | Where it can answer from |
|---|---|---|
| REST API | Pick an operation, fill it in, send it, and read the answer. It writes the request as cURL, JavaScript, Python or Go | Sample data, or your organization |
| Halo MCP server | Pick a tool, edit its arguments, call it, and read what the tool says and the JSON-RPC around it. It writes the call as cURL | Sample data, or your organization |
| Signed embeds | Build a token and see whether Halo would accept it, or paste a token you already have and read it | Your browser only |
Sample data
Choose Sample data. It needs no account and no key. Your browser answers, over a made-up dataset called Sample orders, with a chart and a report to read too. Nothing is sent anywhere.
Answers have the same shapes and problem codes as the real API, so you can learn from them, and bad requests fail the way they would for real. The sample dataset has the fields month, region, channel, revenue and orders, and each tab starts with a request that works.
Your organization
Choose Your organization on the REST API tab to read your own data, as you. You need a key, and have two ways to give it one.
Use a playground key
Sign in with Halo if you haven't, pick an organization if you have several, and choose Make one for this page. The playground holds the key in memory, and you never see or copy it.
| Playground key | API key | |
|---|---|---|
| Lasts | An hour, or until you sign out if that's sooner | 90 days by default, at most 365 |
| Rows a day | 5,000 across your playground keys, and never more than what's left of your own budget | Your plan's budget |
| Works from | The portal's own pages only. Anywhere else gets 403 playground_key | Anywhere |
| How many | Three at most. Making a fourth revokes your oldest | 25 live |
| Can be rolled | No | Yes |
| Notices | None | When made, replaced, ending, or revoked by an Admin |
It has every scope, and reads only what you can read, under your own access levels and row policies. So it needs what any key needs: a role with api.use, the API on for your organization, and for rows, data.export. Sample data needs none of this.
Unlike an API key, a playground key doesn't need a recent sign-in. It ends when you sign out, and otherwise within the hour. Choose Forget it, or reload, to drop it from the page, and revoke it from your keys list to stop it sooner.
Playground keys are listed and logged like any other. They show up in your keys list and in the Admins', marked Playground, and their rows count toward your daily budget. Making more than 20 in an hour gets 429 rate_limited.
Or paste a key
Paste an API key you've already made, to see exactly what it can do, including its scopes. It behaves as it would from your own code: same scopes, same limits, same log.
The key is sent only to the Halo API, and kept in memory: it never reaches storage or the address bar, and goes when you reload or choose Forget it. Roll it if you're on a shared machine. A key you've just made has Use it in the playground, which does the same with no pasting.
The Halo MCP server tab
The Halo MCP server takes its own credential, so a playground key or API key won't open it. Choose Your organization and paste a personal token (hpat_…) from Halo Data, under Account, AI tools. It's also kept in memory, and an Admin has to have turned on AI tools.
Signed embed tokens
This tab runs entirely in your browser. It starts with a practice secret, which Halo won't accept, and signs a token as you change the report, element, lifetime, locked filters and attributes. It checks the token against Halo's rules and shows its header and claims.
Don't paste a real signing secret into any web page. In production, your server signs tokens and the secret stays there: see Signed embeds. A token you paste to read isn't a secret in the same way, but it does open its report until it expires.
From the playground to your code
When a request does what you want, copy it from As code, and run it on your server with a real key read from the environment. Snippets has helpers for paging and retries. Never carry a key into browser code: see Authentication.