Skip to main content

API key authentication

Every request carries an API key in the x-api-key header. The key belongs to a team: everything you create with it lands in that team, and you can only read that team’s projects, videos and media.

Getting your API key

1

Log in

Log in to hooked.so.
2

Open Developer API

3

Create a key

Create a new key and give it a label you will recognize later.
4

Save it

Copy the key and store it somewhere safe, such as your secrets manager or an environment variable. Hooked only stores a hash of it, so it cannot show you the key again.
Each endpoint page in the API Reference shows the full request with an x-api-key header, ready to copy into your terminal or code.

Using your API key in code

For POST requests, also send Content-Type: application/json and a JSON body.

Security best practices

Never put your API key in browser or mobile app code, or in a public repository. Call the API from your server.
Store the key in an environment variable:
Create one key for development and another for production, so you can delete one without breaking the other.
To rotate, create the new key, deploy it, then delete the old one in Settings → Developer API.
If a key is exposed, delete it in the dashboard. Requests with it start answering 401 immediately.

Authentication errors

A missing, wrong or deleted key answers 401:
A valid key whose team does not have access to the Hooked app answers 403:

Testing your key

A 200 with an avatars list means your key works.

Need help?

Developer API

Manage your API keys

Support

Contact our support team