API credentials

Every call to the API is authenticated. There is no anonymous endpoint, not even for the reference lists.

Generating a key

API credentials are created only from the Super Admin account. No other role can create, see or revoke them — which is deliberate: a key is standing access to your account’s data, and that is not a thing an admin should be able to hand out quietly.

1. Sign in to EyeOnTask as the Super Admin.
2. Go to Settings → Integrations, and open the Developer API card — create API keys so your own systems can add jobs and requests to EyeOnTask.

Settings → Integrations

3. API Credentials opens on Your API Keys. Until the first key is made it reads No API keys yet. Generate one to connect your first system. Click Generate API Key, top right.

Settings → Integrations → Developer API

4. Give it a Key Name — the field suggests e.g. Salesforce CRM — and click Generate Key.

Settings → Integrations → Developer API → Generate API Key

5. The new credential appears under Your API Keys with its API Key, Secret Key and Created On date. Copy both keys into your integration’s secret store.

Name the key after the system that will use it — Salesforce CRM, website booking form — because the name is how you will decide, months later, which key you are safe to revoke.

One credential per external system. Two integrations sharing a key means revoking one breaks both.

The headers every request carries

Authorization: Bearer {api_key}:{api_secret}
Accept: application/json

The key and the secret go in one header, separated by a colon, after the word Bearer.

For POST requests, two more:

Content-Type: application/json
Idempotency-Key: {a unique string}

Header	Required for	Value
Authorization	Every request	Bearer {api_key}:{api_secret}
Accept	Every request	application/json
Content-Type	POST only	application/json
Idempotency-Key	POST only	A unique string, up to 255 characters. A UUID v4 is the sensible choice — see idempotency.

Treat the secret like a password

Because that is what it is. Anyone holding the pair can create jobs and requests in your account and look up your customers.

• Keep both in a server-side secret manager, not in source control.
• Never put them in a URL, in browser code, or in a log line.
• Never send them to support, in a ticket or anywhere else.

Note that IP allow-listing is not enforced — a valid credential works from anywhere. The key itself is the whole of the security, which is why where you keep it matters.

If a key is exposed

Revoke it from the same Settings → Integrations → Developer API screen and generate a new one.

A request sent over plain HTTP counts as exposure. The API rejects it:

{
  "success": false,
  "error": {
    "code": "HTTPS_REQUIRED",
    "message": "This API is available over HTTPS only"
  },
  "timestamp": "2026-09-09T14:23:24Z"
}

The rejection protects the request, not the credential — it had already travelled unencrypted before the server could refuse it. Treat that key as compromised: revoke it, generate a new one, and fix the URL scheme in your integration before you use the replacement.