API Overview - hConnect

hConnect exposes two distinct surfaces:

OIDC OP (OpenID Provider): Standard OIDC endpoints (authorization, token, userinfo, jwks) for browser-based sign-in flows.
REST API: Server-to-server endpoints for provider discovery and verification lifecycle.

They use different base URLs and authentication methods. Keep them conceptually separate in your integration.

Quick Links

OIDC OP Endpoints

Authorization, Token, UserInfo, JWKS and discovery document

REST API Endpoints

Providers list and Verification lifecycle endpoints

Error Codes

Unified error model and handling strategies

Environments

Sandbox (testing) and Production (live) are provided for both OIDC and REST.

Environment Details

Compare Sandbox vs Production and find all canonical URLs

OIDC OP Overview

OIDC endpoints are served from the Connect domain and follow the OpenID Provider discovery standard.

Base URLs

ISSUER=https://connect.hopae.com
AUTHORIZATION_ENDPOINT=https://connect.hopae.com/auth
TOKEN_ENDPOINT=$ISSUER/token
USERINFO_ENDPOINT=$ISSUER/userinfo
JWKS_URI=$ISSUER/jwks
WELL_KNOWN=$ISSUER/.well-known/openid-configuration

ISSUER=https://sandbox.connect.hopae.com
AUTHORIZATION_ENDPOINT=https://sandbox.connect.hopae.com/auth
TOKEN_ENDPOINT=$ISSUER/token
USERINFO_ENDPOINT=$ISSUER/userinfo
JWKS_URI=$ISSUER/jwks
WELL_KNOWN=$ISSUER/.well-known/openid-configuration

Authentication & Flows

OAuth2/OIDC Authorization Code flow
Client authentication and scopes configured per application

REST API Overview

REST endpoints are served from the API domain and use Basic Auth for server-to-server calls.

Base URLs

API_BASE_URL=https://api.hopae.com

API_BASE_URL=https://sandbox.api.hopae.com

Authentication

Use Basic Authentication with your Client ID and Client Secret.

In the API playground, set Authorization.username to your Client ID (client_id) and Authorization.password to your Client Secret (client_secret). The header is generated automatically.

curl -X GET "$API_BASE_URL/connect/v1/providers" \
  -u "CLIENT_ID:CLIENT_SECRET"

const credentials = Buffer.from("CLIENT_ID:CLIENT_SECRET").toString("base64");
await fetch(`${process.env.API_BASE_URL}/providers`, {
  headers: { Authorization: `Basic ${credentials}` },
});

import base64, os, requests
creds = base64.b64encode(b'CLIENT_ID:CLIENT_SECRET').decode('utf-8')
resp = requests.get(
    f"{os.environ['API_BASE_URL']}/providers",
    headers={"Authorization": f"Basic {creds}"}
)

Versioning

Current REST API version: v1 (included in the path).

https://sandbox.api.hopae.com/connect/v1/[endpoint]

Common Headers

Header	Value	Description
`Authorization`	`Basic <base64(client_id:client_secret)>`	Your API credentials
`Content-Type`	`application/json`	Required for POST/PUT requests

Support

📧 dev@hopae.com

​Quick Links

OIDC OP Endpoints

REST API Endpoints

Error Codes

​Environments

Environment Details

​OIDC OP Overview

​Base URLs

​Authentication & Flows

​REST API Overview

​Base URLs

​Authentication

​Versioning

​Common Headers

​Support

Quick Links

Environments

OIDC OP Overview

Base URLs

Authentication & Flows

REST API Overview

Base URLs

Authentication

Versioning

Common Headers

Support