Developer reference

Identify each device.
Protect each credential.

Hardware requests use a device API key. Web users sign in with their account and use a server-side session.

Device requests

Use the Authorization header.

Authorization: Bearer <DEVICE_API_KEY>
Content-Type: application/json

Create a device in your workspace to obtain its key. Keep it out of browser code and public repositories. Regenerate it if exposed and update the device firmware configuration.

Web form actions use session authentication and CSRF tokens. A device key does not replace a web user account.