Authentication
Create, scope, secure and revoke API keys.
Every request to the API or the MCP server is authenticated with an API key, sent as a bearer token in the Authorization header:
Authorization: Bearer hopla_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxCreate a key
On app.hopla.page, open Réglages (Settings), then API et MCP, and click Nouvelle clé (New key).
- Nom (name): identifies the key, for example "Claude Code" or "Weekly report".
- Peut modifier ma page (write access): when enabled, the key can read and write the profile, theme and blocks. When disabled, the key has read-only access to the page and analytics.
The key is shown only once. Hopla stores only its SHA-256 hash, so it cannot be recovered: if you lose it, create a new one.
An account can have up to 10 keys. Use one key per integration, so each can be revoked independently.
Permissions
| Operation | Read-only key | Read and write key |
|---|---|---|
| Read the page, account and reference values | Yes | Yes |
| Read analytics and the summary | Yes | Yes |
| Read the email list and subscribers | Yes | Yes |
| Fetch website, feed or review page metadata | Yes | Yes |
| Update settings and blocks, upload images | No, 403 read_only_key | Yes |
| Delete subscribers, sync subscribers | No, 403 read_only_key | Yes |
| MCP tools exposed | The 16 read tools | All 25 tools |
A key can only access the page of the account that created it. GET /api-keys lists the account keys without exposing their secret: see Account.
Plan requirements
The API and MCP server are included in the Pro plan and in the 14-day trial. If the account leaves the Pro plan, its keys are suspended (403 plan) but not deleted, and are reactivated when the account returns to Pro.
On a self-hosted instance without billing configured (see the self-hosting guide), every account has access to the API and MCP server on the instance domain: https://your-domain/api/v2 and https://your-domain/mcp.
Security
Protect your keys
A key with write access grants full control over the page. Never expose it in client-side code, a mobile app or a Git repository.
- Store keys in environment variables or a secrets manager.
- Use a read-only key for dashboards and agents that do not need to modify the page.
- Revoke unused or leaked keys in Réglages, API et MCP. Revocation is immediate.
The API does not use cookies, so a cross-origin request has no privileges without a key. CORS is therefore open to all origins.