Skip to main content
Keys are sk_hopper_ followed by 32 random bytes, base64url-encoded. The gateway stores only a SHA-256 hash and a display prefix (sk_hopper_ plus the next 4 characters). The full key is shown exactly once, at creation — copy it then, because it cannot be retrieved later.

​
Create and revoke

Manage keys at withhopper.com/console/keys. Key management is dashboard-only; there is no self-serve key API. Revocation is immediate — the next request with a revoked key returns 401 api_key_disabled.

​
Passing the key

Every HTTP route reads the key from the Authorization header.
WebSocket routes also accept the key as a query parameter at upgrade, for clients that cannot set headers on the handshake:

​
Storage

Keep the key in an environment variable on your server. Never ship it in client-side code — a key in a browser bundle or mobile app is public, and anyone holding it spends your credits. If a key leaks, revoke it in the console and mint a new one.

​
401 responses

No key on the request:
Key does not exist:
Key was revoked: 401 with code api_key_disabled and message “This API key has been disabled.” At WebSocket upgrade the same envelope is written as a raw HTTP response before the upgrade completes; a missing key there returns 401 invalid_api_key with message “Provide an API key via the Authorization header or ?api_key=.” If key verification itself is temporarily down, requests return 503 verify_unavailable. Retry within seconds; the key is fine.