Hookpost OAuth Apps
An API key works for your own account. An OAuth app is what you build when other people need to connect their Hookpost account to your product — they approve access on a Hookpost screen and you never handle their credentials.
Which one do I need?
| Your own account only | Use an API key — Public API docs. Simpler, no flow to implement. |
| Other people's accounts | Use OAuth — this page. Never ask a user for their API key. |
The flow
Register your application
In Hookpost, open Settings → Developer and create an OAuth application. You will get a client id beginning pca_ and a client secret. Store the secret server-side — it is shown once.
Register every redirect URI you will use. The authorize step rejects any redirect that is not an exact match.
Send the user to authorize
Redirect the user to the authorize screen. Generate a PKCE code_verifier, hash it with SHA-256 and send the base64url result as the code_challenge. Only S256 is supported.
GET https://hookpost.hookstep.in/api/oauth/authorize ?client_id=pca_YOUR_CLIENT_ID &redirect_uri=https://yourapp.com/callback &response_type=code &scope=mcp:read%20mcp:write &state=RANDOM_STRING &code_challenge=BASE64URL_SHA256_OF_VERIFIER &code_challenge_method=S256
The user approves, and Hookpost redirects back to your redirect_uri with ?code=…&state=…. Check that state matches what you sent.
Exchange the code for a token
curl -X POST "https://hookpost.hookstep.in/api/oauth/token" \
-H "Content-Type: application/json" \
-d '{
"grant_type": "authorization_code",
"code": "CODE_FROM_REDIRECT",
"client_id": "pca_YOUR_CLIENT_ID",
"client_secret": "YOUR_CLIENT_SECRET",
"redirect_uri": "https://yourapp.com/callback",
"code_verifier": "YOUR_ORIGINAL_VERIFIER"
}'You get back a bearer token:
{
"access_token": "pos_...",
"token_type": "bearer"
}Call the API as that user
Send the token in the Authorization header of any Public API request — same header as an API key, no Bearer prefix.
curl "https://hookpost.hookstep.in/api/public/v1/integrations" \ -H "Authorization: pos_YOUR_ACCESS_TOKEN"
Requests run against the account that granted access — their channels, their posts.
Scopes
| mcp:read | Read channels, posts and analytics |
| mcp:write | Create, update and delete posts |
Request only what you use. An integration that just reads analytics should not ask for mcp:write.
Userinfo
To identify the account behind a token:
curl "https://hookpost.hookstep.in/api/oauth/userinfo" \ -H "Authorization: pos_YOUR_ACCESS_TOKEN"
Dynamic client registration
Hookpost supports OAuth Dynamic Client Registration at /oauth/register, used mainly by AI clients that register themselves. Those clients get a pcd_ client id and must use PKCE.
Registration is restricted to an allowlist of domains, so it is not open to the public internet. If you are building a normal integration, register in the dashboard instead — step 1 above.
Notes worth reading twice
- The
Authorizationheader takes the raw token — there is noBearerprefix. - Redirect URIs must match exactly, including scheme, host, port and path.
- If a token returns
401 No subscription found, that account needs an active plan — a new token will not help. - Client secrets belong on your server. A public client (mobile, browser) should rely on PKCE alone.