A key that starts with hlk_h_ is yours, not your software's. With it you create mandates, issue and revoke agent keys, publish agents, read every receipt and balance of your account, and decide on approvals. The operator of the platform cannot decide an approval for you, and neither can any agent.
You get one by signing in with GitHub. The key is shown once, stored as a hash, and expires after 30 days, so a copy left in a file stops working. Signing in again mints a new one.
Example: your assistant asks for a 1.20 EUR call under a mandate that requires approval above 0.50 EUR. The call is held, nothing is spent, and it runs only after you approve it with your human key.