On 28 July 2026 the Hex team announced that Hex.pm will disable HTTP Basic authentication on its API. Throughout October 2026, Basic auth requests will fail with 401 Unauthorized during escalating brown-outs. On 1 November 2026 it is disabled permanently.
The reason is simple: a username and password cannot carry a second factor. As long as Basic auth works, a password alone authenticates an API request even if the account has 2FA enabled. Removing it lets Hex require 2FA for API access.
What's affected
Any script, CI job or tool that talks to the Hex.pm API with a username and password. OAuth tokens and API keys are not affected. The official Hex CLI already uses the OAuth device grant for interactive login.
Brown-out windows grow through October (all times UTC): two 1-hour windows a day in the first week, 2 hours in the second, 4 hours in the third, 8 hours in the fourth, and two 10-hour windows a day from 29 to 31 October. Start times change daily, so no job reliably avoids them.
What to do now
- Find tooling that sends a Hex username and password:
grep -rn -i "hex" .github .gitlab-ci.yml Dockerfile scripts 2>/dev/null | grep -i -E "user|password|auth"
- Switch interactive use to OAuth and CI to an organization API key, which can be scoped and revoked independently of any person. Send it in the
Authorizationheader. - If you maintain a client library or CI integration that exposes Basic auth, release a version that uses OAuth or API keys.
- Write down who owns each key and when it was created. Contact support@hex.pm if you hit migration problems.
How this could have been avoided
This is a hardening change, so the question is what it fixes.
- Credentials that cannot carry MFA are the gap. A reused or phished password was enough to act as the account. Moving to OAuth with 2FA, and scoped keys for CI, closes it.
- Separate machine identity from a person. Organization keys avoid tying releases to one developer's password.
- Rehearse with the brown-outs. Failures in October show you which jobs still use Basic auth while rollback is easy.
Quick check
Do API keys stop working on 1 November?
No. Only HTTP Basic authentication on the API is disabled. OAuth tokens and API keys keep working.
