API keys
Your first request, in a few minutes.
Personal API keys connect your scripts and integrations to Holo Folder. Create a key, keep it on your server, and send it with each request.
Using Claude, ChatGPT, Cursor or Codex?
Use the AI setup guides to connect through MCP with your Holo Folder login. You won't need to create or paste an API key.
Create a key
Create a key here using your signed-in account. You can also manage the same keys in Settings → Account → Developer access in the app.
Generate an API key
Use your Holo Folder account. Start with read access, and grant writes only when you need them.
Loading developer access…
- Sign in above if you haven't already.
- Give the key a name you'll recognise, such as “Collection export”.
- Choose its permissions and expiry. Start with read access.
- Copy the full key and save it somewhere secure. It's shown only once.
A current Premium subscription or lifetime licence is required. Signup trials do not include developer access.
Authentication
Send the full key in the Authorization header with the Bearer prefix:
Authorization: Bearer hf_YOUR_KEY_ID.YOUR_SECRETKeep the key in a server environment variable. Never put it in a URL, browser bundle or public repository. The REST API uses personal API keys; browser cookies and MCP OAuth tokens cannot replace them.
Make your first request
This request returns up to ten cards. Replace the placeholder with your key:
export HOLOFOLDER_API_KEY='hf_YOUR_KEY_ID.YOUR_SECRET'
curl --fail-with-body \
-H "Authorization: Bearer $HOLOFOLDER_API_KEY" \
'https://app.holofolder.com/app/api/v1/cards?limit=10'Use the returned nextCursor with the same filters to continue. See pagination for the full convention.
Prefer to try it in your browser? Open Search cards, select Try in Playground, enter your key, and send a request. The explorer also generates code examples from your inputs.
Choose permissions
Read access is the default. Select writes explicitly only when your integration needs them. Each endpoint in the API explorer lists the permissions it requires.
| Permission | What it allows |
|---|---|
catalog:read | Browse cards, sets and Pokémon |
binders:read, collection:read | Read your binders, collection and wanted cards |
prices:read | Read available price evidence |
settings:read | Read settings and account identity |
binders:write, collection:write, settings:write | Change the corresponding account data |
prices:refresh | Request provider refreshes within their limits |
sharing:manage, partners:manage | Manage sharing and partner access |
A valid key still needs paid access and the right permissions. Partner access follows current membership. Revocation is checked on every request.
Expiry, rotation & revocation
Keys expire after 30, 90 or 365 days, with 90 days as the default. Each account can have up to ten active keys.
Revoke a key at any time in developer settings. Rotation creates a new key; existing secrets cannot be recovered. Update your integration to use the replacement, then revoke the old one.