| Method | Best for |
|---|---|
| Private Integration key | Your own account — instant setup, long-lived token |
| OAuth 2.0 | Marketplace apps that access other users’ accounts |
Create a Private Integration
Create a new integration
Click + Add Integration. Give it a clear name — something like 
My Automation or Data Sync Script.
Select permissions
Choose only the scopes your integration needs. Granting fewer permissions reduces risk if a key is exposed.
Common scopes:

| Scope | What it allows |
|---|---|
| Contacts (Read/Write) | Get, create, update, and delete contacts |
| Conversations (Read/Write) | Read threads, send messages |
| Calendars (Read/Write) | List calendars, create appointments |
| Opportunities (Read/Write) | Manage deals and pipeline stages |
| Payments (Read) | View invoices and transactions |
Using your key in requests
Every API request requires two headers:| Header | Value | Purpose |
|---|---|---|
Authorization | Bearer YOUR_API_KEY | Authenticates your request |
Version | 2021-07-28 | Pins the API to a stable version — always send this |
Keep your key secure
- Never commit API keys to git — use environment variables
- Use separate keys for development and production
- Rotate keys immediately if you suspect exposure
- Delete unused integrations to reduce your attack surface
When to use OAuth instead
Switch to OAuth 2.0 when you’re building an app that needs to access other users’ HoopAI accounts (e.g., a marketplace app). See the OAuth 2.0 guide for the full setup.Next step
Make your first request
Test your key with a live API call and see what comes back