API Keys

API keys authenticate the CLI and allow programmatic access to your HookReplay account.

What are API Keys?

API keys are secure tokens that authenticate requests to HookReplay's services. They're used by:

  • CLI Tool: To receive webhook replays
  • API Integrations: To programmatically access your webhooks
Keep Your Keys Secret

Treat API keys like passwords. Never commit them to version control or share them publicly.

Creating an API Key

Go to API Keys settings

Navigate to Settings → API Keys in your account.

Click "Create API Key"

Click the button to generate a new API key.

Name your key

Give your key a descriptive name (e.g., "MacBook CLI", "CI/CD Pipeline", "Development").

Copy and save

Copy the key immediately. For security, the full key is only shown once.

One-time Display

API keys are only displayed in full once. If you lose it, you'll need to create a new one.

API Key Format

HookReplay API keys follow this format:

Format 
hr_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

The hr_ prefix makes it easy to identify HookReplay keys in your codebase or environment.

Using API Keys

With the CLI

Configure your API key using the interactive CLI:

terminal 
# Start the CLI
hookreplay

# Configure your API key (saved to ~/.hookreplay/config.json)
config api-key hr_xxxxxxxxxxxx

# Connect to the server
connect

Config File Location

The API key is stored in your config file at:

Config path 
~/.hookreplay/config.json

Verify Configuration

View your current configuration at any time:

terminal 
● hookreplay> config
┌─────────────┬──────────────────────────┐
│ Setting     │ Value                    │
├─────────────┼──────────────────────────┤
│ API Key     │ hr_xxxxx****             │
│ Server URL  │ https://hookreplay.dev   │
└─────────────┴──────────────────────────┘

Managing API Keys

View existing keys

Go to Settings → API Keys to see all your active keys, including their names and creation dates.

Revoke a key

Click the delete button next to any key to revoke it immediately. The key will stop working instantly.

Revocation is Immediate

When you revoke a key, any CLI sessions using it will disconnect immediately.

Security Best Practices

Use Environment Variables

Never hardcode API keys in your code. Use environment variables instead.

One Key Per Device

Create separate keys for each device or service for easy revocation.

Rotate Regularly

Periodically rotate your API keys, especially after team members leave.

Add to .gitignore

Ensure .env files containing keys are in your .gitignore.

Compromised Key?

If you believe an API key has been compromised:

  1. Revoke immediately: Go to Settings → API Keys and delete the compromised key
  2. Create a new key: Generate a fresh API key
  3. Update your systems: Replace the old key in all your environments
  4. Audit usage: Check your webhook history for any suspicious activity