Getting started · 2026-08-28 · HippoAPI Documentation Team

Authenticate with an API key

Create, store, scope, rotate, and send HippoAPI keys without exposing them to clients.

Send a bearer token

Send the key in the Authorization header as a Bearer token. Use HTTPS and construct this header only in trusted server-side code.

Authorization: Bearer $HIPPOAPI_API_KEY

Keep environments separate

Create different keys for local development, staging, and production. Give each key a clear name and apply expiry, quota, model, or IP restrictions where they match the deployment.

Rotate a suspected key

If a key may be exposed, disable or delete it immediately, issue a replacement, update the secret store, and inspect Usage Logs. Do not wait for proof of misuse.