Get API Keys

Use this page when you need credentials for calling WLTE OpenAPI.

In the Developer Console, an API key is created as an API Client. After creation, you receive two values:

Value	Purpose
clientId	Public identifier for the API Client
clientSecret	Secret used by your server to request access tokens

Together, clientId and clientSecret are the credentials you use to obtain an access token.

What the Developer Console Manages

Area	Purpose
API Keys	Create API Clients and obtain clientId / clientSecret
Permissions	Control which devices and operations an integration can access
Credential lifecycle	Rotate, disable, or remove credentials
Troubleshooting	Use client ID, request ID, and timestamps when contacting support

Where to Create an API Key

1. Sign in to the Developer Console: https://developer.svnwi.com/wlte
2. Open your application.
3. Go to API Client management.
4. Create an API Client.
5. Select the minimum scopes required by your integration.
6. Save the generated clientId and clientSecret.

How the Key Is Used

Your server exchanges the credentials for a short-lived access token:

POST /wlte/v1/auth/token

Then your server calls REST APIs with the token:

Authorization: Bearer {accessToken}

Do not call device APIs directly with clientSecret. The secret is only used to request access tokens.

Required Security Rules

• Store clientSecret only in server-side secret storage.
• Do not place clientSecret in browser code, mobile apps, public repositories, screenshots, or logs.
• clientSecret is shown only when created or rotated. Save it immediately.
• If the secret is lost, rotate it. The original value cannot be viewed again.
• Use separate API Clients for production, staging, and local testing when possible.
• Disable API Clients that are no longer used.

Permissions

Scopes control what the API Key can do. For example, a key with read-only access cannot control relays or change device configuration.

If an API call returns AUTH_SCOPE_DENIED, update the API Client scopes in the Developer Console, save the change, obtain a new access token, and retry.

See Permissions & Security.

Rotation and Disable Behavior

Credential lifecycle changes are enforced by the API server:

Change	Expected behavior
Secret rotated	Old secret can no longer request new tokens
API Client disabled	New token requests fail, and protected APIs reject existing tokens
API Client deleted	New token requests fail, and protected APIs reject existing tokens
Permissions changed	Existing tokens are checked against the current permission state

Plan rotation so your server is updated before the old secret is stopped.