Authentication

How to authenticate your API requests

All Hookdrop API requests must include a valid Bearer token in the Authorization header.

Base URL: https://hookdrop.dev/api

Never share your access token. Treat it like a password — anyone who has it can make requests on your behalf.

Register

Create a new Hookdrop account. You can also sign up at hookdrop.dev/auth/register.

curl -X POST https://hookdrop.dev/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "name": "Your Name", "password": "yourpassword"}'

Request body

email · string · required

Your email address. Must be unique — returns 409 if already registered.

name · string · required

Your display name.

password · string · required

Your chosen password.

Response — 201 Created

{
  "user": {
    "id": "3f6e2a91-bd14-4c3a-9c71-8e2d1f0a4b56",
    "email": "[e-mail]",
    "name": "Your Name",
    "plan": "free"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

---

Login

Exchange your email and password for an access token and a refresh token.

curl -X POST https://hookdrop.dev/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "password": "yourpassword"}'

Request body

email · string · required

The email address associated with your Hookdrop account.

password · string · required

Your account password.

Response

{
  "user": {
    "id": "3f6e2a91-bd14-4c3a-9c71-8e2d1f0a4b56",
    "email": "[e-mail]",
    "name": "Ada Lovelace",
    "plan": "free"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

user · object · required

The authenticated user.

Show properties

id · string

Unique identifier for the user.

email · string

The user’s email address.

name · string

The user’s display name.

plan · string

The user’s current plan (free, starter, pro, team).

accessToken · string · required

A JWT used to authenticate API requests. Expires after 15 minutes.

refreshToken · string · required

A long-lived token used to obtain a new access token. Expires after 30 days.

Refresh your token

Access tokens expire after 15 minutes. Use your refresh token to get a new access token without logging in again.

curl -X POST https://hookdrop.dev/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."}'

Request body

refreshToken · string · required

The refresh token you received when you logged in.

Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

accessToken · string · required

A new JWT access token. Valid for 15 minutes.

Use the token

Pass your access token in the Authorization header on every API request.

curl https://hookdrop.dev/api/endpoints \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"