Developer Preview
The Chameleon Eye API is in developer preview. Production access is not yet generally available.
API Docs
API Authentication
Authentication methods, API key security, and session token management for Chameleon Eye API.
Authentication Overview
Chameleon Eye API is authenticated. All API requests require a valid credential.
Chameleon Eye API is authenticated. All API requests require a valid credential. Unauthenticated requests return HTTP 401.
API Key Rules
Follow these rules to keep your API keys secure.
+API keys must be kept server-side.
+Never embed API keys in browser JavaScript, mobile app bundles, or desktop client packages.
+Use server-to-server calls from your backend.
+Rotate keys immediately if compromised.
Short-Lived Tokens for Desktop and Mobile
Desktop Connector and mobile clients use device activation with short-lived tokens.
+Desktop Connector uses secure device activation flow.
+Short-lived session tokens are issued after device activation.
+Tokens expire and require refresh.
+Device revocation is available from admin panel.
Request Headers
Include these headers with every authenticated API request.
Authorization: Bearer <your-api-key> Content-Type: application/json
Security Recommendations
Best practices for keeping your credentials safe.
+Store API keys in environment variables, not in code.
+Use secrets managers in production.
+Rotate keys on any suspected exposure.
+Use scoped keys where available.