HackerOne Getting Started: Account, Keys, & First Request (2026)

Getting started overview

Getting started with HackerOne for organizations involves establishing an account, generating API credentials, and making an authenticated request to interact with the platform. This process enables the programmatic management of security programs, including bug bounties, vulnerability disclosure programs (VDPs), and security assessments. HackerOne provides an API designed for integration with existing security tools and workflows, allowing for automation of report management, program configuration, and data retrieval.

The HackerOne platform supports various security program types, from public bug bounties to private vulnerability disclosure initiatives. Organizations utilize HackerOne to engage a global community of security researchers to identify and report vulnerabilities in their assets. The API facilitates the exchange of information between the HackerOne platform and an organization's internal systems, such as ticketing systems or security information and event management (SIEM) tools.

To begin, users will typically:

1. Create an organizational account on the HackerOne platform.
2. Generate API keys within the account settings for authentication.
3. Construct and execute an initial API request using the generated keys.
4. Integrate the API into existing security and development workflows.

This guide focuses on the initial steps required to establish API access and perform a basic interaction. For comprehensive details on API endpoints and data models, refer to the HackerOne API documentation.

Quick reference table

Create an account and get keys

To interact with the HackerOne API, an organizational account is required. This account serves as the central point for managing security programs, collaborating with researchers, and accessing platform features. If an organization does not yet have a HackerOne account, the first step is to complete the HackerOne organization signup process.

Generating API keys

After creating and logging into your HackerOne organizational account, API keys can be generated from the platform's settings. These keys consist of a username and a password, which are used for HTTP Basic Authentication when making API requests. It is important to treat these keys as sensitive credentials, similar to production login details.

1. Log In: Access your HackerOne organizational dashboard.
2. Navigate to Settings: Locate the 'Settings' or 'Organization Settings' section, typically accessible via a gear icon or a dropdown menu associated with your profile.
3. Find API Keys: Within the settings, look for a section labeled 'API Keys' or 'API Access'.
4. Create New Key: Initiate the creation of a new API key. The platform will generate a unique API username and password. Record these credentials securely, as the password may only be displayed once.
5. Set Permissions (Optional but Recommended): Depending on the HackerOne plan and features, you may have options to define specific permissions for the API key. Grant only the necessary permissions to adhere to the principle of least privilege. For an initial test, read-only access to program information might be sufficient.

HackerOne's API uses a standard HTTP Basic Authentication scheme. When making requests, the API key username and password are encoded and sent in the Authorization header. Secure storage and handling of these keys are critical to prevent unauthorized access to your HackerOne data and programs.

Your first request

With an organizational account established and API keys generated, you can now make your first API request. This example demonstrates how to fetch information about your organization's programs using the HackerOne API. We will use cURL as a common command-line tool for making HTTP requests.

API Endpoint

The HackerOne API base URL is https://api.hackerone.com/v1/. A common starting point is to list programs, which can be accessed via an endpoint like /programs or endpoints specific to your organization.

Example: Fetching Organization Programs

To fetch a list of programs associated with your organization, you can use the following cURL command. Replace YOUR_API_USERNAME and YOUR_API_PASSWORD with your actual API key credentials.

curl -u "YOUR_API_USERNAME:YOUR_API_PASSWORD" \
     -H "Accept: application/json" \
     "https://api.hackerone.com/v1/programs"

Explanation of the command:

• curl: The command-line tool for transferring data with URLs.
• -u "YOUR_API_USERNAME:YOUR_API_PASSWORD": Specifies the username and password for HTTP Basic Authentication. The curl command will automatically encode these credentials.
• -H "Accept: application/json": Sets the Accept header, indicating that the client prefers to receive a JSON response.
• "https://api.hackerone.com/v1/programs": The target API endpoint to retrieve program information.

Upon successful execution, the API will return a JSON array containing details of your organization's programs. A successful response typically includes program names, states, and other relevant attributes. For instance, a snippet of a successful response might look like:

{
  "data": [
    {
      "type": "program",
      "id": "1234",
      "attributes": {
        "name": "Example Program",
        "handle": "exampleprogram",
        "state": "active",
        "created_at": "2023-01-01T12:00:00Z"
      }
    },
    // ... more programs
  ]
}

This confirms that your API keys are correctly configured and that you can successfully authenticate and retrieve data from the HackerOne API.

Common next steps

Once you have successfully made your first API call, several common next steps can further integrate HackerOne into your security operations:

• Explore Other Endpoints: Review the HackerOne API documentation to understand the full range of available endpoints. This includes endpoints for managing reports, inviting researchers, updating program scope, and retrieving vulnerability data.
• Integrate with Ticketing Systems: Automate the creation and updating of tickets in your issue tracking system (e.g., Jira, ServiceNow) when new vulnerabilities are reported on HackerOne. This typically involves using webhooks from HackerOne or polling the API for new reports.
• Automate Report Management: Implement workflows to automatically triage, assign, or update the status of reports based on predefined criteria, reducing manual overhead.
• Enhance Security Workflows: Integrate HackerOne data into your broader security tooling, such as SIEMs or security orchestration, automation, and response (SOAR) platforms, to centralize vulnerability intelligence.
• Implement Webhooks: Configure HackerOne webhooks to receive real-time notifications about events such as new reports, report updates, or bounty payments. This pushes data to your systems rather than requiring constant polling of the API.
• Develop Custom Dashboards: Extract program data to build custom dashboards or reports that provide deeper insights into your security posture and program performance.
• Secure API Keys: Implement robust security practices for managing API keys, such as using environment variables, secret management services, and rotating keys regularly.

Troubleshooting the first call

When making your first API call, you might encounter issues. Here are common problems and their solutions:

• 401 Unauthorized Error:

  • Issue: This is the most common error, indicating that your authentication credentials are incorrect or missing.
  • Solution: Double-check your API username and password for typos. Ensure they are correctly passed in the -u flag of the cURL command. Remember that API keys are case-sensitive. Verify that the keys are active in your HackerOne settings.

• 403 Forbidden Error:

  • Issue: Your API key might lack the necessary permissions to access the requested resource.
  • Solution: Review the permissions granted to your API key in the HackerOne settings. Ensure that the key has at least read access to the programs endpoint. If you are trying to perform a write operation (e.g., creating a report), ensure the key has write permissions for that specific action.

• 404 Not Found Error:

  • Issue: The API endpoint you are trying to reach does not exist or is incorrectly specified.
  • Solution: Verify the URL of the endpoint against the HackerOne API documentation. Ensure there are no typos in the path or base URL.

• Invalid JSON Response:

  • Issue: The API returns data that is not valid JSON, or the response is empty.
  • Solution: Ensure you have included the -H "Accept: application/json" header in your cURL request. This tells the server to send JSON data. If the response is empty, it might indicate no data for the requested resource, or an underlying server error. Check the HTTP status code for more clues.

• Network Connectivity Issues:

  • Issue: The request times out or fails to connect to the HackerOne API server.
  • Solution: Check your internet connection. If you are behind a corporate firewall, ensure that access to api.hackerone.com on port 443 (HTTPS) is permitted.