Skip to main content
POST
https://sandbox.api.hopae.com/connect/v1
/
apps
curl -X POST \
  -H "Authorization: Bearer sk_workspace_test_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 5d42c2c4-f7a3-4c0b-8a6d-2d3c6d38b9c9" \
  -d '{"name":"My App"}' \
  "https://sandbox.api.hopae.com/connect/v1/apps"

{
  "client_id": "abc123",
  "client_secret": "sh_app_...",
  "name": "My App",
  "branding": { "name": "My App", "logo": "iVBORw0KGgoAAAANSUhEUgAA..." },
  "redirect_uris": [],
  "verification": { "request_attributes": [], "providers": [] },
  "webhook_config": {
    "url": "https://hooks.example.com/hopae",
    "enabled": true,
    "events": ["verification.completed", "verification.failed"],
    "retry_attempts": 3,
    "timeout_seconds": 10
  },
  "created_at": 1731465600
}
Creates an app and returns its credentials.

​
Request

​
Authorization
string
required
Bearer <API_KEY> from Console > Developers > Workspace API Keys.
​
Content-Type
string
application/json
​
Idempotency-Key
string
Optional UUID to safely retry without creating duplicates.

​
Request Body

​
name
string
default:"My App"
required
Display name for the app.

​
Response

Returns the created App object, including the client secret. Store it securely. 
curl -X POST \
  -H "Authorization: Bearer sk_workspace_test_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 5d42c2c4-f7a3-4c0b-8a6d-2d3c6d38b9c9" \
  -d '{"name":"My App"}' \
  "https://sandbox.api.hopae.com/connect/v1/apps"

{
  "client_id": "abc123",
  "client_secret": "sh_app_...",
  "name": "My App",
  "branding": { "name": "My App", "logo": "iVBORw0KGgoAAAANSUhEUgAA..." },
  "redirect_uris": [],
  "verification": { "request_attributes": [], "providers": [] },
  "webhook_config": {
    "url": "https://hooks.example.com/hopae",
    "enabled": true,
    "events": ["verification.completed", "verification.failed"],
    "retry_attempts": 3,
    "timeout_seconds": 10
  },
  "created_at": 1731465600
}
Immutable fields: id, client_id, and client_secret. Update attempts are rejected with a 400 ValidationError.