Authentication
API keys
Integrations authenticate with an API key as a bearer token:
Authorization: Bearer rtf_xxxxxxxxxxxxxxxxxxxxxxxx
- Create keys in Settings → API keys. Only signed-in people can create or revoke keys; keys can't manage other keys.
- A key is shown once. Tracker stores only a hash, and lists each key by its prefix with when it was last used.
- A key acts for its organisation and can reach everything under
/v1, except creating and revoking keys. - Use one key per system, so you can revoke one without breaking the others. Keep keys on servers, never in a browser or mobile app.
A missing, unknown or revoked key gets 401 unauthorised.
Other credentials (for reference)
| Credential | Used by | Notes |
|---|---|---|
| Session cookie | The admin and console web apps | Writes must come from the same site (403 bad_origin otherwise). Not for integrations. |
| Device token | The Tracker app | Issued when an operative pairs their phone. Revoked by Sign out app. |
| Tracking token | The customer's tracking page | In the link itself. Read-only, and only for that visit. |
| Share-location token | The operative's share-location link | Can start, update and finish that one visit. |
Before you can create visits
Your organisation's email must be confirmed (403 email_unverified), and the organisation approved (403 not_eligible). Organisations in the listed sectors are approved when they register.