API Keys

API keys give applications, scripts, and edge integrations programmatic access to Fentrica without a human login. A key is a long-lived credential you present on every request instead of signing in — ideal for server-to-server automation.

What an API key is

Organization-wide. Each key belongs to one organization. You grant it access per resource, either across the whole organization or scoped to specific sites.
Presented as a header. Send it as X-Api-Key: lrv_… on each request.
Shown once. The secret is displayed only when you create the key. Copy it immediately and store it securely — Fentrica keeps only a hash and cannot show it again.

Unlike a user session, an API key has no interactive login and does not expire when a person logs out. Treat it like a password.

Permission model

A key carries one or more grants. Each grant combines:

a resource — what the key can touch,
an access level — read or read & write, and
a scope — the whole organization, or one or more specific sites.

Resources available today:

Resource	Levels	What it allows
Edge devices	read & write	Connect to and send commands to the edge devices (controllers) at your sites through the broker — for example creating connections and controlling equipment. (Read-only is not offered yet.)
Maintenance requests	read · read & write	Read lists and views maintenance requests; read & write also creates new ones.

Under the hood each grant is a string [{siteId}:]{resource}:{level} — for example edge-device:read_write (organization-wide) or d4e5f6…:edge-device:read_write (one site). You normally never type these; the UI builds them for you.

Creating a key

Open your organization and go to Managers.
Select the API Keys tab.
Click New API Key.
Give the key a descriptive name (e.g. Edge commander (prod)).
For each resource, pick an access level. Leave it on None to grant nothing for that resource.
For any resource you grant, add site rules: leave the default Entire organization, or choose specific sites to limit the key.
Click Create.
Copy the key now. It is shown only once (lrv_…). Store it in your secret manager before closing the dialog.

Using a key

Send the key on every request in the X-Api-Key header:

curl -H 'X-Api-Key: lrv_…' https://…

For a complete, working example — sending a command to an edge device — see Edge Device REST API.

Managing keys

The API Keys list shows each key's grants and when it was last used (or Never used).
Revoke a key at any time from the list; revocation is immediate and permanent.
Keys cannot be edited or re-displayed. To rotate, create a new key, switch your integration to it, then revoke the old one.

Security best practices

Least privilege. Grant only the resources and levels the integration needs, and prefer site-scoped grants over organization-wide ones.
One key per integration. Separate keys make it safe to revoke one without breaking the others, and make last-used activity meaningful.
Keep the secret server-side. Never embed a key in a browser app, mobile app, or public repository.
Rotate on suspicion. If a key may have leaked, create a replacement and revoke the old one.

Expert Guide