Authentication

Every request to the OpenAlarm Core API (api.openalarm.io) is authenticated with an account-level API key.

Pre-release

The API is in active design and is not yet live. The flow below is what it is being built against.

Generating an API Key

In the OpenAlarm app, go to Your Name > Account > API Keys and generate a new key.

Copy your key now - it is shown only once

An API key is displayed only once, at the moment you create it. Copy it and store it somewhere safe; it cannot be retrieved again. If you lose it, generate a new key and delete the old one.

The key is send-only - it authorizes the ingest actions (arm, disarm, trigger, panic) and nothing else. It cannot read data, change configuration, or access your account.

Sending the API Key

Send the key on every request, one of two equivalent ways. X-API-Key is the canonical form; an Authorization: Bearer token is also accepted.

Using X-API-Key

X-API-Key: YOUR_API_KEY

curl -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  https://api.openalarm.io/v1/k7m3x9q2f8d4w1b5/trigger

Using a Bearer Token

Send the key in the Authorization header as a bearer token - the word Bearer, a single space, then your key:

Authorization: Bearer YOUR_API_KEY

curl -X POST \
  -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.openalarm.io/v1/k7m3x9q2f8d4w1b5/trigger

Every endpoint accepts GET or POST (the two are equivalent), and requests are bodyless - the URL is the whole call. The key gates the request; the alarm ID in the path names which alarm it acts on. The examples above use POST; a webhook source that can only issue a GET works the same way.

What Comes Back

Status	Meaning
2XX	Accepted. The exact success code and body are being finalized (pre-release).
401	The API key is missing or invalid.
403	Unauthorized.
404	Alarm ID not found.

See the API Reference for the full endpoint contract.