Authentication

Every request must include your API key using one of two header formats — pick whichever fits your HTTP client:

X-API-Key header

curl https://api.iotee.app/v1/public/vehicles \
  -H "X-API-Key: iot_live_xxxxxxxxxxxxxxxx"

Bearer token

curl https://api.iotee.app/v1/public/vehicles \
  -H "Authorization: Bearer iot_live_xxxxxxxxxxxxxxxx"

Key format

Keys always start with iot_live_. Treat your key like a password — it is shown only once when created and cannot be retrieved again. If you lose it, ask your administrator to revoke it and issue a new one.

Scopes

A key can never do more than the admin who issued it. Additionally, keys may be limited to a specific set of scopes (e.g. vehicle.view, trip.view) — a request to an endpoint outside your key's scopes returns 403.

Errors

Auth and rate-limit errors use a simple shape:

{ "error": "invalid API key" }

All other errors use the standard envelope:

{ "success": false, "message": "..." }