Authentication

The platform API accepts two authentication methods, depending on who is calling.

API key — organizations (prop firms)

Organization endpoints accept an API key via the X-API-Key header for programmatic access from your backend — no browser session needed.

curl "https://api.hyperprop.com/platform/v1/organization/trading-accounts" \
  -H "X-API-Key: hp_live_your_key_here"

Keys are managed by organization admins in the dashboard and can be rotated or revoked at any time.
Each key carries permissions: read, write, or admin. Endpoints that create or modify data require write or admin; a key without them gets INSUFFICIENT_PERMISSIONS.
Keys are stored hashed (SHA-256) — the raw hp_live_... value is shown once at creation and cannot be retrieved later.

Create a read-only key for anything that only needs to observe state — reporting jobs, dashboards, read-only AI agents.

Bearer token (JWT) — users and dashboard

Most endpoints accept a JWT via Authorization: Bearer <token>. This is what the Hyperprop dashboard and client applications use; user-scoped endpoints (profile, notifications, demo accounts) require it.

curl "https://api.hyperprop.com/platform/v1/user/profile" \
  -H "Authorization: Bearer eyJhbGciOi..."

Bearer-token (user-session) endpoints — and the entire Trade API and Market Data API — are browser-callable only from Hyperprop’s own apps. Third-party web frontends need an approved origin (contact us). This is a browser-origin restriction: server-to-server calls send no Origin header and are unaffected.

Partner session — third-party apps acting for a trader

A third-party application (trade copier, journal, analytics tool) trades on behalf of an individual trader by exchanging its partner app credentials plus a trader-generated key (hpk_...) for a short-lived, firm-scoped Trade API token:

curl -X POST "https://api.hyperprop.com/trade/partner/session" \
  -H "Content-Type: application/json" \
  -d '{
    "app_id": "your-app-uuid",
    "app_secret": "your-app-secret",
    "api_key": "hpk_the_traders_key",
    "firm": "example-firm"
  }'

The returned token reaches only that trader’s accounts at that one firm, and the trader can revoke their key at any time. This is a supported integration path, distinct from an organization key — full walkthrough in Partner integrations.

Which one do I use?

You are…	Use
A prop firm backend calling Organization endpoints	`X-API-Key`
A user-facing app acting on behalf of a signed-in user	`Authorization: Bearer`
A partner app trading for a trader	Partner session → `Authorization: Bearer`
An AI agent via the MCP connector	`X-API-Key` (or OAuth)

Organization endpoints accept either of the first two methods; everything in this documentation’s examples uses the API key.

Get Started

Core Concepts

Guides

API key — organizations (prop firms)

Bearer token (JWT) — users and dashboard

Partner session — third-party apps acting for a trader

Which one do I use?

​API key — organizations (prop firms)

​Bearer token (JWT) — users and dashboard

​Partner session — third-party apps acting for a trader

​Which one do I use?

API key — organizations (prop firms)

Bearer token (JWT) — users and dashboard

Partner session — third-party apps acting for a trader

Which one do I use?