Overview
API keys are simple credentials that authenticate your server with the Open Wearables API. Unlike JWT tokens, they don’t expire automatically and remain valid until explicitly deleted or rotated.Key Format
All API keys follow this format:- Prefix:
sk-(secret key) - Length: 32 hexadecimal characters
- Generation: Cryptographically secure random generation
Using API Keys
Include your API key in theX-Open-Wearables-API-Key header for all API requests:
API Endpoints
All API key management endpoints require JWT authentication (developer portal access).Create API Key
Human-readable name to identify this API key. Useful for tracking which services use which keys.
API keys are associated with the authenticated developer who creates them.
The API key value. This is the only time you’ll see the full key - store it securely.
The name you assigned to this key.
UUID of the developer who created this key.
ISO 8601 timestamp when the key was created.
List API Keys
For security, the full key value is never returned in list operations - only the key ID and metadata.
Update API Key
The full API key ID (e.g.,
sk-a1b2c3d4...)New name for the API key.
Rotate API Key
The API key ID to rotate.
Delete API Key
The API key ID to delete.
Best Practices
Use descriptive names
Use descriptive names
Name your API keys based on their purpose or environment:
- ✅ “Production Server - AWS Lambda”
- ✅ “Staging Environment”
- ✅ “Data Pipeline - Hourly Sync”
- ❌ “Key 1”
- ❌ “Test”
Separate keys per environment
Separate keys per environment
Create different API keys for each environment:
- Development
- Staging
- Production
Rotate keys regularly
Rotate keys regularly
Implement a key rotation schedule:
- High-security: Every 30 days
- Standard: Every 90 days
- Minimum: Every 6 months
- Call
/rotateto get new key - Deploy new key to your services
- Verify services are using new key
- Old key is automatically deleted
Store keys securely
Store keys securely
Never expose API keys in:
- Client-side JavaScript
- Mobile app source code
- Git repositories
- Logs or error messages
- URLs or query parameters
- Environment variables
- Secret management services (AWS Secrets Manager, HashiCorp Vault)
- Encrypted configuration files
Monitor API key usage
Monitor API key usage
Track which keys are actively used:
- Set up logging for API key authentication
- Delete unused keys immediately
- Alert on unusual activity patterns
- Review key list monthly
Handle compromised keys immediately
Handle compromised keys immediately
If an API key is compromised:
- Delete the key immediately via
/api/v1/api-keys/{key_id} - Create a new key with a different name
- Update all affected services
- Review logs for unauthorized access
- Consider rotating other keys as a precaution
Error Responses
| Status Code | Error | Description |
|---|---|---|
401 | Unauthorized | Invalid or missing API key |
403 | Forbidden | Valid key but insufficient permissions |
404 | Not Found | API key does not exist |
422 | Validation Error | Invalid request body (e.g., missing name) |
429 | Rate Limited | Too many requests - slow down |
Complete Integration Example
Here’s a complete example of managing API keys in a Python application:api_key_manager.py
Related Documentation
JWT Token Authentication
Learn about session-based authentication for the developer portal
Authentication Overview
Compare authentication methods and choose the right one
