Authentication

Authenticate with the Hookdrop API using JWT bearer tokens

Every request to the Hookdrop API must include a valid access token in the Authorization header:

Authorization: Bearer YOUR_ACCESS_TOKEN

Keep your tokens secure. Never expose them in client-side code, public repositories, or anywhere they can be read by untrusted parties.

Register a new account

If you don’t have an account yet, create one with POST /api/auth/register.

email · string · required

Your email address.

password · string · required

Your account password.

cURL

curl -X POST https://hookdrop.dev/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[e-mail]",
    "password": "your-password"
  }'

Response

user · object

Show properties

id · string

Unique identifier for your account.

email · string

The email address associated with your account.

plan · string

Your current plan: free, starter, or pro.

accessToken · string

Short-lived JWT you send with every API request. Expires after 15 minutes.

refreshToken · string

Long-lived token used to obtain a new access token when the current one expires.

{
  "user": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "email": "[e-mail]",
    "plan": "free"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

---

Log in to an existing account

Exchange your credentials for tokens using POST /api/auth/login.

email · string · required

Your account email address.

password · string · required

Your account password.

cURL

curl -X POST https://hookdrop.dev/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[e-mail]",
    "password": "your-password"
  }'

Response

{
  "user": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "email": "[e-mail]",
    "plan": "free"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

---

Refresh an access token

Access tokens expire after 15 minutes. When yours expires, call POST /api/auth/refresh with your refresh token to get a new one without logging in again.

refreshToken · string · required

The refresh token returned from /auth/login or /auth/register.

cURL

curl -X POST https://hookdrop.dev/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{
    "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }'

Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

---

Using your token

Include the access token in the Authorization header of every API request:

Authorization: Bearer YOUR_ACCESS_TOKEN

For example, to list your endpoints:

cURL

curl https://hookdrop.dev/api/endpoints \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"