Authentication

API keys

Every request carries an API key as a bearer token. Keys start with iq_live_, belong to one account, and are shown in full only once, when they are created.

Authorization: Bearer iq_live_…

curl "https://api.induqt.ai/v1/sites" \
  -H "Authorization: Bearer $INDUQT_API_KEY"

Create keys in the app under Settings → API keys, or with the API once you have a key with the write scope. Keep keys in environment variables or a secrets manager, never in source control or in a browser page.

Scopes

A key can do only what its scopes allow. Each endpoint in the API reference names the one scope it needs; give a key every scope the integration uses and no more.

Typical combinations:

• Gateway or Node-RED flow: ingest only, limited to one site.
• Dashboard or report: read.
• Provisioning script or MCP client: read, write and ingest.

A request with a valid key but without the scope it needs answers 403. See Errors.

Site-scoped keys

Set siteId when creating a key to limit it to one site. A site-scoped key can only read and write that site's machines and data, and can only ingest into it. This is the right choice for anything installed at a plant: if the device is lost, only one site is exposed.

A site-scoped key also lets ingest resolve a machine's externalId without sending siteId in every request.

curl -X POST "https://api.induqt.ai/v1/api-keys" \
  -H "Authorization: Bearer $INDUQT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Node-RED line 2",
  "scopes": [
    "ingest"
  ],
  "siteId": "6f1c2c0e-4b1a-4c55-9d0e-1f2a3b4c5d6e"
}'

{
  "id": "7d2e1f00-3a4b-4c5d-9e6f-a1b2c3d4e5f6",
  "key": "iq_live_7Hk2…(shown once)",
  "name": "Node-RED line 2",
  "scopes": [
    "ingest"
  ]
}

Tenancy

Every site, machine, reading, recording, connector and key belongs to exactly one account. A key only ever sees its own account's data. Ids from another account are answered with 404 Not Found, the same as ids that do not exist, so a response never reveals whether another account's resource exists.

Rotating keys

1. Create the new key

   Same name with a suffix, same scopes and site.

2. Deploy it

   Update the environment variable or secret wherever the old key is used, and restart the process.

3. Check the old key is idle

   List keys and confirm the old key's lastUsedAt has stopped moving. The secret itself is never returned.

   GET /v1/api-keysCopy

   curl "https://api.induqt.ai/v1/api-keys" \
     -H "Authorization: Bearer $INDUQT_API_KEY"

4. Revoke the old key

   See below.

Revoking keys

Revoking takes effect immediately: the next request with that key answers 401. Revoke from Settings in the app or with:

curl -X DELETE "https://api.induqt.ai/v1/api-keys/7d2e1f00-3a4b-4c5d-9e6f-a1b2c3d4e5f6" \
  -H "Authorization: Bearer $INDUQT_API_KEY"