> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyperprop.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys for your backend, Bearer tokens for user sessions.

The platform API accepts two authentication methods, depending on who is
calling.

## API key — organizations (prop firms)

Organization endpoints accept an API key via the `X-API-Key` header for
programmatic access from your backend — no browser session needed.

```bash theme={null}
curl "https://api.hyperprop.com/platform/v1/organization/trading-accounts" \
  -H "X-API-Key: hp_live_your_key_here"
```

* Keys are managed by organization admins in the dashboard and can be
  **rotated or revoked** at any time.
* Each key carries permissions: `read`, `write`, or `admin`. Endpoints that
  create or modify data require `write` or `admin`; a key without them gets
  `INSUFFICIENT_PERMISSIONS`.
* Keys are stored **hashed (SHA-256)** — the raw `hp_live_...` value is shown
  once at creation and cannot be retrieved later.

<Tip>
  Create a **read-only key** for anything that only needs to observe state —
  reporting jobs, dashboards, read-only AI agents.
</Tip>

## Bearer token (JWT) — users and dashboard

Most endpoints accept a JWT via `Authorization: Bearer <token>`. This is what
the Hyperprop dashboard and client applications use; user-scoped endpoints
(profile, notifications, demo accounts) require it.

```bash theme={null}
curl "https://api.hyperprop.com/platform/v1/user/profile" \
  -H "Authorization: Bearer eyJhbGciOi..."
```

<Warning>
  Bearer-token (user-session) endpoints — and the entire Trade API and Market
  Data API — are **browser-callable** only from Hyperprop's own apps.
  Third-party web frontends need an approved origin (contact us). This is a
  browser-origin restriction: server-to-server calls send no `Origin` header
  and are unaffected.
</Warning>

## Partner session — third-party apps acting for a trader

A third-party application (trade copier, journal, analytics tool) trades on
behalf of an individual trader by exchanging its partner app credentials plus
a trader-generated key (`hpk_...`) for a short-lived, firm-scoped Trade API
token:

```bash theme={null}
curl -X POST "https://api.hyperprop.com/trade/partner/session" \
  -H "Content-Type: application/json" \
  -d '{
    "app_id": "your-app-uuid",
    "app_secret": "your-app-secret",
    "api_key": "hpk_the_traders_key",
    "firm": "example-firm"
  }'
```

The returned token reaches only that trader's accounts at that one firm, and
the trader can revoke their key at any time. This is a supported integration
path, distinct from an organization key — full walkthrough in
[Partner integrations](/guides/partner-integrations).

## Which one should you use?

| You are...                                                         | Use                                       |
| ------------------------------------------------------------------ | ----------------------------------------- |
| A prop firm backend calling Organization endpoints                 | `X-API-Key`                               |
| A user-facing app acting on behalf of a signed-in user             | `Authorization: Bearer`                   |
| A [partner app](/guides/partner-integrations) trading for a trader | Partner session → `Authorization: Bearer` |
| An AI agent via the [MCP connector](/guides/mcp-connector)         | `X-API-Key` (or OAuth)                    |

Organization endpoints accept **either** of the first two methods; everything
in this documentation's examples uses the API key.


## Related topics

- [Sign in with Google](/platform-api/authentication/sign-in-with-google.md)
- [Disable TOTP](/platform-api/authentication/disable-totp.md)
- [Get X connection status](/platform-api/authentication/get-x-connection-status.md)
- [Disconnect X account](/platform-api/authentication/disconnect-x-account.md)
- [Disconnect Discord account](/platform-api/authentication/disconnect-discord-account.md)