Every request to the Hoppier API carries an API key in the Authorization header.
Get a key
API keys are issued by Hoppier during the beta. Email support@hoppier.com from your admin account and tell us which admin the key should belong to.
Self-serve keys, which you create, name and revoke in the Hoppier dashboard, are coming soon.
Send it
- Send the key as a bearer token:
Authorization: Bearer hk_live.…. The word Bearer is case-sensitive.
- A key has three parts separated by dots:
hk_live, an 8-character prefix, and a 48-character secret.
- Hoppier shows a key once. Keep it in a secrets manager or an environment variable, never in your source code.
- Never put a key in code that runs in a browser or a mobile app. Anyone who has it can act as the admin it belongs to.
- Every request goes to
https://app.hoppier.com/api/v1 over HTTPS.
What a key can do
A key issued today is a personal key:
- It belongs to one admin in one company. It can read that company’s programs and add people to them, and nothing else.
- Its owner must be an admin of the company. To add people, the account also needs an active Hoppier subscription.
- If that admin is removed from the company, or stops being an admin, the key stops working. Ask us for a new one.
GET /validate tells you which admin and company a key belongs to. It’s the quickest way to check a key.
There is no sandbox or test mode. Every key works against your live account: adding a participant adds a real person to a real program and uses one of your invitations. Test on a program you made for the purpose, with your own email addresses.
If a key leaks
Email support@hoppier.com straight away. We’ll switch it off and issue a new one. 
