> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hoppier.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How Hoppier API keys work during the beta: how to get one, how to send it, and what it can do.

Every request to the Hoppier API carries an API key in the `Authorization` header.

## Get a key

API keys are issued by Hoppier during the beta. Email [support@hoppier.com](mailto:support@hoppier.com) from your admin account and tell us which admin the key should belong to.

Self-serve keys, which you create, name and revoke in the Hoppier dashboard, are [coming soon](/guides/coming-soon.md).

## Send it

```bash theme={null}
curl https://app.hoppier.com/api/v1/validate \
  -H "Authorization: Bearer $HOPPIER_API_KEY"
```

* Send the key as a bearer token: `Authorization: Bearer hk_live.…`. The word `Bearer` is case-sensitive.
* A key has three parts separated by dots: `hk_live`, an 8-character prefix, and a 48-character secret.
* Hoppier shows a key once. Keep it in a secrets manager or an environment variable, never in your source code.
* Never put a key in code that runs in a browser or a mobile app. Anyone who has it can act as the admin it belongs to.
* Every request goes to `https://app.hoppier.com/api/v1` over HTTPS.

## What a key can do

A key issued today is a **personal key**:

* It belongs to **one admin in one company**. It can read that company's programs and add people to them, and nothing else.
* Its owner must be an admin of the company. To add people, the account also needs an active Hoppier subscription.
* If that admin is removed from the company, or stops being an admin, the key stops working. Ask us for a new one.

[`GET /validate`](/api-reference/validate) tells you which admin and company a key belongs to. It's the quickest way to check a key.

> [!WARNING]
>
> There is no sandbox or test mode. Every key works against your live account: adding a participant adds a real person to a real program and uses one of your invitations. Test on a program you made for the purpose, with your own email addresses.

## If a key leaks

Email [support@hoppier.com](mailto:support@hoppier.com) straight away. We'll switch it off and issue a new one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.