> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hoppier.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Check your API key

> Confirms that a key works and tells you which admin and company it belongs to.

Every key Hoppier accepts gets a 200 here, whatever its owner's role. Use it as a connection test, not as a permission check.




## OpenAPI

````yaml /openapi.yaml get /validate
openapi: 3.1.0
info:
  title: Hoppier API
  version: 1.0.0-beta
  summary: Read your Hoppier programs and add people to them.
  description: >
    The Hoppier API is in **closed beta**. Everything in this reference runs in
    production today.


    - API keys are issued by Hoppier during the beta. Email
    [support@hoppier.com](mailto:support@hoppier.com) to request one.

    - There is no sandbox. Every key works against your live account.

    - We add fields and error codes without notice, so ignore anything you don't
    recognise. We don't rename or remove a documented field without announcing
    it on the [changelog](https://docs.hoppier.com/changelog) first.
  termsOfService: https://www.hoppier.com/terms
  contact:
    name: Hoppier support
    email: support@hoppier.com
servers:
  - url: https://app.hoppier.com/api/v1
    description: Production
security:
  - apiKey: []
tags:
  - name: Account
    description: Check an API key and see which account it belongs to.
  - name: Programs
    description: Read the reward programs in your account.
  - name: Participants
    description: Add people to a program.
paths:
  /validate:
    get:
      tags:
        - Account
      summary: Check your API key
      description: >
        Confirms that a key works and tells you which admin and company it
        belongs to.


        Every key Hoppier accepts gets a 200 here, whatever its owner's role.
        Use it as a connection test, not as a permission check.
      operationId: validateApiKey
      responses:
        '200':
          description: The key works.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidateResponse'
              example:
                connectionId: 1a2b3c4d
                email: admin@example.com
                company: Acme Inc.
                keyType: user
                message: OK
        '400':
          $ref: '#/components/responses/KeyMissingOrMalformed'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  schemas:
    ValidateResponse:
      type: object
      required:
        - connectionId
        - email
        - company
        - keyType
        - message
      properties:
        connectionId:
          type: string
          description: >-
            The key's public prefix. Safe to log and to show as a connection
            label.
          examples:
            - 1a2b3c4d
        email:
          type:
            - string
            - 'null'
          description: Email of the admin the key belongs to.
          examples:
            - admin@example.com
        company:
          type: string
          description: Name of the company the key belongs to.
          examples:
            - Acme Inc.
        keyType:
          type: string
          enum:
            - user
            - company
          description: >-
            Every key issued today is `user`, a personal key. Company keys are
            coming soon.
        message:
          type: string
          const: OK
    Error:
      type: object
      required:
        - message
      properties:
        message:
          type: string
          description: What went wrong, in plain words. Don't parse it; it can change.
        error:
          type: string
          description: >
            A machine-readable code. Present on some errors today
            (`rate_limited`, `rate_limit_unavailable`, `in_progress`,
            `idempotency_key_reuse`, `request_outcome_unknown`), and on every
            error after the next API update.
        parameter:
          type: string
          description: >-
            On some validation errors, the field (or the value) that was
            refused.
        code:
          type: string
          description: >-
            Only on the 402 `send_credits_exhausted` response today. It moves to
            `error` in the next API update.
  responses:
    KeyMissingOrMalformed:
      description: >-
        The `Authorization` header is missing, or the key isn't in the
        `hk_live.<prefix>.<secret>` format.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            missingKey:
              summary: No API key
              value:
                message: API key is missing
            malformedKey:
              summary: Malformed key
              value:
                message: Invalid API key format provided
                parameter: API Key
    Unauthorized:
      description: The API key is wrong, unknown or switched off.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            invalidKey:
              summary: Wrong or unknown key
              value:
                message: user is unauthorized
            inactiveKey:
              summary: Key switched off
              value:
                message: API key is inactive
    RateLimited:
      description: >
        Too many requests. Wait the number of seconds in `Retry-After`, then
        retry. The per-account limit answers in JSON; the per-address limit
        answers in plain text today and can send a fraction of a second, so
        round it up. See [Errors and rate
        limits](/guides/errors-and-rate-limits).
      headers:
        Retry-After:
          $ref: '#/components/headers/RetryAfter'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: rate_limited
            message: >-
              Too many requests for this account. Retry after the number of
              seconds in Retry-After.
        text/plain:
          schema:
            type: string
          example: Too Many Requests
    ServerError:
      description: >
        Something went wrong on Hoppier's side. Retry with backoff; if it keeps
        happening, email support@hoppier.com. Today `message` can contain
        internal text: log it, but don't show it to your users.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: An unexpected error occurred.
  headers:
    RetryAfter:
      description: Seconds to wait before retrying.
      schema:
        type: string
      example: '30'
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: hk_live.<prefix>.<secret>
      description: >
        Send your key in the `Authorization` header: `Authorization: Bearer
        hk_live.…`. The word `Bearer` is case-sensitive.


        Keys are issued by Hoppier during the beta and shown once. Treat them
        like passwords and never put one in code that runs in a browser or an
        app.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.