Hotjar Authentication: API Keys and User Access (2026)

Authentication overview

Hotjar employs distinct authentication mechanisms for its web application and its Data Export API. User authentication for the Hotjar platform itself relies on traditional email and password combinations or integrates with third-party single sign-on (SSO) providers like Google. This secures access for individuals managing Hotjar projects, viewing heatmaps, recordings, and survey results directly through the Hotjar dashboard.

For programmatic interactions, specifically with the Hotjar Data Export API, an API key serves as the primary authentication method. API keys are unique identifiers that authenticate applications or scripts making requests to retrieve data from a Hotjar organization. This method ensures that systems integrating with Hotjar can securely access analytics data without requiring individual user login credentials.

The design of Hotjar's authentication system distinguishes between interactive user sessions and automated API access, aligning with common security practices for SaaS platforms. All communication with Hotjar servers, whether through the web application or the API, is encrypted using HTTPS/TLS protocols, protecting data in transit as described in Hotjar's security documentation.

Supported authentication methods

Hotjar supports a combination of authentication methods tailored for different use cases:

• User Login (Web Application): Primarily for direct access to the Hotjar dashboard.
• API Key (Data Export API): Exclusively for programmatic access to export data.

Below is a table summarizing the supported authentication methods, their typical use cases, and general security considerations.

Hotjar's implementation of API keys follows a common pattern for API authentication, where a unique string is passed with each request to identify the calling client. This method is suitable for server-to-server communication where the key can be kept confidential.

Getting your credentials

API Key

To obtain an API key for the Hotjar Data Export API, you must have Administrator permissions within your Hotjar organization. The process typically involves:

1. Logging into your Hotjar account.
2. Navigating to the 'Organization Settings'.
3. Locating the 'API Keys' section.
4. Generating a new API key.

Once generated, the API key will be displayed. It is crucial to copy and store this key securely, as it will only be shown once for security reasons. If lost, you will need to generate a new key and update any applications using the old one. Hotjar recommends reviewing their official documentation on generating API tokens for the most up-to-date steps and best practices.

User Login Credentials

For standard user login:

• Email and Password: When creating a Hotjar account, you establish an email and password. These are used for direct login. Password resets are handled through the Hotjar login page.
• Google SSO: If your account is linked to Google, selecting the 'Sign in with Google' option on the Hotjar login page will redirect you to Google's authentication flow.

Account management, including changing passwords or enabling two-factor authentication (if available for user login), is typically done within your Hotjar User Profile settings.

Authenticated request example

To interact with the Hotjar Data Export API, you typically include your API key in the request headers. The following example demonstrates a common pattern using a curl command to make an authenticated request. This example assumes you have an API key and are trying to access a hypothetical endpoint for data export.

curl -X GET \
  'https://api.hotjar.com/v1/organizations/{organization_id}/sites/{site_id}/data/recordings' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json'

In this example:

• YOUR_API_KEY should be replaced with the actual API key generated from your Hotjar organization settings.
• {organization_id} and {site_id} are placeholders for your specific Hotjar organization and site identifiers, which can usually be found in the Hotjar dashboard URLs or API documentation.
• The Authorization: Bearer header is a standard way to pass an API key or token, following the OAuth 2.0 Bearer Token usage guidelines, even when not using a full OAuth flow.
• Content-Type: application/json specifies that the request expects a JSON response.

Refer to the Hotjar Data Export API documentation for specific endpoints, parameters, and response formats.

Security best practices

Adhering to security best practices is essential when managing Hotjar authentication credentials and integrating with its API:

• Treat API Keys as Sensitive: API keys grant access to your Hotjar data. Treat them with the same level of security as passwords. Avoid hardcoding them directly into client-side code, public repositories, or sharing them unnecessarily. Store them in environment variables or a secure secret management system.
• Least Privilege Principle: If Hotjar offers different levels of API keys or user roles, always use the one with the minimum necessary permissions for a given task. This limits potential damage if a key is compromised. Hotjar offers various access level permissions for team members.
• Regular Key Rotation: Periodically generate new API keys and revoke old ones. This practice reduces the window of exposure for a compromised key. The frequency depends on your organization's security policy.
• Monitor Usage: Keep an eye on the activity associated with your API keys. Unusual spikes in requests or data access could indicate a compromise.
• Secure Transmission: Always use HTTPS/TLS for all API communications. Hotjar enforces this, but it's a general best practice for any API interaction to encrypt data in transit.
• Enable Multi-Factor Authentication (MFA) for User Logins: For direct Hotjar web application access, enable MFA if available. This adds an extra layer of security beyond just a password, significantly reducing the risk of unauthorized access due to stolen credentials.
• Strong, Unique Passwords: For Hotjar accounts not using SSO, ensure users create strong, unique passwords that are not reused across other services.
• Audit User Access: Regularly review who has access to your Hotjar organization and what their permission levels are. Remove access for individuals who no longer require it.
• Secure Development Practices: When building integrations, follow secure coding guidelines. For example, sanitize inputs to prevent injection attacks and properly handle errors to avoid revealing sensitive information.
• Stay Informed: Keep up-to-date with Hotjar's security announcements and documentation to be aware of any new security features or recommendations.