API Keys and the API Reference

Hi.Events API keys let other tools and your own code work with your account: pull orders into your CRM, export sales for your accountant, or print badges from attendee data. A key acts as you, so it can do what you can do in the account and nothing more.

How to Get There

Click your profile icon and choose My Profile
Click API keys in the left menu (under Account)

Everyone on the account can create their own keys. Keys belong to one account, so if you’re in several Hi.Events accounts, create a key in each one you want to connect.

Creating a Key

Click Create API key
Give it a Name that tells you where it’s used, like “Zapier” or “Website sync”
Choose its Access:
- Read and write: create and change events, orders, attendees and more
- Read-only: view data and run exports, but can’t change anything
Choose when it expires under Expiration: 7, 30, 60, 90 or 180 days, 1 year, or No expiration. New keys default to 90 days
Confirm it’s you with your Current password. If you don’t have a password, you’re asked to sign in again instead
Click Create key

The next screen, Copy your API key, is the only time you’ll see the full key. Click Copy key and store it somewhere safe, like a password manager or your integration’s secret settings. The screen also has a ready-made Try it command that checks the key works. Keys start with hie_.

You need a confirmed email address to create keys. If yours isn’t confirmed, resend the confirmation email from Profile.

What a Key Can Do

A key has your role and your event access. If you can only see certain organizers or events, so can your key, and if your role changes, the key changes with it straight away.

Viewers can only create Read-only keys
Members who can’t see financials can’t use a key to read revenue or order totals either
“Keys can’t sign in or manage your team, payouts, profile or security settings.” They can’t create other API keys or change account settings either

Each person can have up to 25 active keys in an account.

Managing Your Keys

The list shows each key’s name and access, when it was created, when it was Last used and when it Expires. Keys close to their expiry date are highlighted, and expired keys move into an Expired group.

Revoke a key to stop it working straight away. This can’t be undone
Remove an expired key to clear it from the list

Admins see a My keys / Everyone switch. Everyone shows every key on the account with its owner, so you can revoke a key someone else created. The owner gets an email when that happens.

Emails About Your Keys

Hi.Events emails you when:

A key is created for you. If you get this email and didn’t create a key, revoke it straight away and change your password
An admin revokes one of your keys
A key is about to expire. This comes a week before, for keys that last 30 days or more

When Keys Stop Working

Besides expiring or being revoked, keys stop working automatically when:

You’re deactivated on the account. Your keys are deleted, so reactivating you doesn’t bring them back
Your password is reset through Forgot password. This deletes your keys in every Hi.Events account you belong to
You disconnect Google or Microsoft sign-in on your Security page. This also deletes your keys in every account
Your single sign-on changes, for example when your account starts requiring it

Keys are also paused while the account requires two-factor authentication and you haven’t set it up, and while the account is scheduled for deletion. Changing your password yourself, or turning two-factor authentication off, doesn’t affect your keys.

The API Reference

Click API reference at the top of the API keys page to browse every endpoint, with the fields each one accepts and returns. You can add your key on that page and send test requests from it.

Using a Key

Send the key in the Authorization header of every request:

curl https://YOUR_API_BASE_URL/events \
  -H "Authorization: Bearer hie_your_key" \
  -H "Accept: application/json"

Copy the exact base URL from the example request under Using your key on the API keys page, or from the top of the API reference.

Rate Limits

Requests are limited per minute. The limit is per person, and it’s shared between the Hi.Events dashboard and all of your keys, so a busy script can slow down your own use of the dashboard. If you go over it, the API replies with 429 and a Retry-After header that says how many seconds to wait.

Lists and Pagination

List endpoints return one page at a time. Use these query parameters:

Parameter	What it does
`page`	Which page to fetch, starting at 1
`per_page`	How many results per page. The default is 25
`sort_by` and `sort_direction`	Sort order, `asc` or `desc`. The fields you can sort by are listed in the response’s `meta.allowed_sorts`
`query`	A search term, like the search box in the dashboard
`filter_fields`	Filters in the form `filter_fields[field][operator]=value`. The fields you can filter on are listed in `meta.allowed_filter_fields`

Errors

Errors come back as JSON with a message, and access errors include an error_code. The common ones:

Code	Meaning
`401`	The key is missing, wrong, expired or revoked
`403` `API_KEY_READ_ONLY`	A read-only key tried to change something
`403` `API_KEY_NOT_ALLOWED`	That endpoint can’t be used with a key
`403` `PERMISSION_REQUIRED`	Your role doesn’t allow it, for example refunds or financial data
`403` `ACCESS_RESTRICTED`	You don’t have access to that organizer or event
`403` `READ_ONLY_ROLE`	You’re a Viewer, so the key can’t change anything
`403` `TWO_FACTOR_SETUP_REQUIRED`	The account requires two-factor authentication and you haven’t set it up
`403` `ACCOUNT_PENDING_DELETION`	The account is scheduled for deletion
`429`	Too many requests. Wait and try again

What You Can Do With the API

The API covers most of what you do in the dashboard, including:

Events and organizers: create, update, duplicate, publish and archive events, and manage organizer settings, locations and email templates
Tickets and products: products, product categories, capacity, and per-date prices on recurring events
Orders: list, view, update, refund, cancel, mark as paid, resend confirmations and export. You can’t place orders through the API, but adding an attendee by hand creates an order for them
Attendees: list, update, export, resend tickets and add attendees by hand
Check-in: create and manage check-in lists
Marketing: promo codes, affiliates and the waitlist
Questions and messages: registration questions and answers, and messages to attendees
Reports: the same reports as the dashboard. Organizer reports can also be exported
Your website: widgets, lineup and schedule
Webhooks: create and manage webhooks

Ideas

CRM sync: pull new attendees into your CRM every hour, and use webhooks to hear about new orders the moment they happen
Badge printing: export attendees with their checkout answers and send them straight to your badge printer’s software
Finance: export orders and reports into your accounting tool on a schedule
Zapier and Make: call the API with their HTTP or webhook steps, using a key in the Authorization header

Tips

Create one key per tool, named after it, so you can revoke one without breaking the others
Use Read-only keys for anything that only reads data, such as reporting and exports
Pick an expiry date for keys that run on someone else’s servers. Only use No expiration for servers you control
Treat a key like a password. Never put it in a website’s front-end code or a public repository, and if it leaks, revoke it and create a new one
For a key that should keep working when someone leaves, create it from a member who’ll stay on the account, with only the access the integration needs

Single Sign-On (SSO)Embedding Ticket Widgets

Last updated 20 October 2026