Introduction
Authentication
Every request to the Hipsy API needs a token that tells Hipsy which user the request is for and what it may access. There are two ways to get one: an API key or OAuth 2.0.
Which one do I need?
| API key | OAuth 2.0 | |
|---|---|---|
| Meant for | Your own website or integration, for your own account | A server-side app that many Hipsy users connect to their own account |
| How you get it | Create it yourself in the Hipsy dashboard | Hipsy registers your app and gives you a client_id and secret |
| Who logs in | Nobody, you paste the key into your integration | Each user logs in on Hipsy and approves your app |
| Access | Everything your account can access | Only the scopes and organisations the user approved |
| Expires | Never, until you delete it | Access tokens after 1 hour, renewed with a refresh token |
| Revoke | Delete the key in the dashboard | The user disconnects your app on hipsy.nl |
Use an API key when you connect Hipsy to your own website or tool, like the WordPress plugin or Zapier. Read The API key.
Use OAuth 2.0 when you build an app for other organisers. They never have to share an API key with you: they log in on Hipsy, choose what your app may access, and can disconnect it at any time. Read OAuth 2.0.
Sending the token
Both tokens work the same way in a request. Send the token in the Authorization header as a Bearer token:
curl https://api.hipsy.nl/v1/organisations/index \
-H "Accept: application/json" \
-H "Authorization: Bearer {api-key-or-access-token}"
All endpoints in the API reference accept both. Each endpoint lists the OAuth scope it needs. API keys don't use scopes.