> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withhopper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Mint and revoke sk_hopper_ keys in the console; pass them via the Authorization header

Keys are `sk_hopper_` followed by 32 random bytes, base64url-encoded. The gateway stores only a SHA-256 hash and a display prefix (`sk_hopper_` plus the next 4 characters). The full key is shown exactly once, at creation — copy it then, because it cannot be retrieved later.

## Create and revoke

Manage keys at [withhopper.com/console/keys](https://withhopper.com/console/keys). Key management is dashboard-only; there is no self-serve key API. Revocation is immediate — the next request with a revoked key returns 401 `api_key_disabled`.

## Passing the key

Every HTTP route reads the key from the `Authorization` header.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.withhopper.com/v1/models \
    -H "Authorization: Bearer $HOPPER_API_KEY"
  ```

  ```python Python theme={null}
  import os
  from openai import OpenAI

  client = OpenAI(
      base_url="https://api.withhopper.com/v1",
      api_key=os.environ["HOPPER_API_KEY"],
  )
  ```

  ```typescript TypeScript theme={null}
  import OpenAI from "openai";

  const client = new OpenAI({
    baseURL: "https://api.withhopper.com/v1",
    apiKey: process.env.HOPPER_API_KEY,
  });
  ```
</CodeGroup>

WebSocket routes also accept the key as a query parameter at upgrade, for clients that cannot set headers on the handshake:

```text theme={null}
wss://api.withhopper.com/stt/websocket?api_key=sk_hopper_...&model=nemotron-asr
```

## Storage

Keep the key in an environment variable on your server. Never ship it in client-side code — a key in a browser bundle or mobile app is public, and anyone holding it spends your credits. If a key leaks, revoke it in the console and mint a new one.

## 401 responses

No key on the request:

```json theme={null}
{"error":{"message":"You didn't provide an API key. Get one at https://withhopper.com/dashboard and pass it via the Authorization header: 'Authorization: Bearer sk_hopper_...'.","type":"invalid_request_error","code":"invalid_api_key","param":null}}
```

Key does not exist:

```json theme={null}
{"error":{"message":"Incorrect API key provided. Check your key at https://withhopper.com/dashboard.","type":"invalid_request_error","code":"invalid_api_key","param":null}}
```

Key was revoked: 401 with code `api_key_disabled` and message "This API key has been disabled."

At WebSocket upgrade the same envelope is written as a raw HTTP response before the upgrade completes; a missing key there returns 401 `invalid_api_key` with message "Provide an API key via the Authorization header or ?api\_key=."

If key verification itself is temporarily down, requests return 503 `verify_unavailable`. Retry within seconds; the key is fine.