Home / Documentation / Credentials & OpenAPI

Credentials & OpenAPI

When platform data has to reach a customer’s own systems, credentials plus OpenAPI do the integration. The credential decides which data can be read, the secret is stored only as a hash and shown once, and it can be revoked at any time.

4 sections · Updated with each platform release

Create a credential

Jiwu AIoT Platform · [object Object] Interface mock
ProductsDevicesData ScreensAI AssistantCredentials
Credentials + New credential
Credential nameAppKeyBound productsStatusERP integration-productionAK7f3d…9c21Air compressor type A and 2 more● EnabledCustomer portal-demoAK2b8e…4d77Cold room thermostat● Enabled
AppSecretsk-•••••••••••••••• (shown once at creation)②Copy and store it nowVisible product scopeAir compressor type A · Cold room thermostat③Grant the minimum necessary scope

Secrets are stored server-side as hashes and never returned by list endpoints; credentials can be revoked at any time and take effect immediately.

[object Object]
  1. 1[object Object]
  2. 2[object Object]
  3. 3[object Object]
  1. Open "Credentials" and click new.
  2. Enter a credential name that states the purpose and the consumer (for example "ERP integration-production").
  3. Bind the product scope the credential may see; select only the data that is really needed.
  4. After saving, copy the AppKey and AppSecret immediately: the AppSecret is shown in plain text only once, at creation.
  5. Hand the secret to the integrating party through a secure channel — not in a ticket or a chat log.

NoteThe AppSecret is stored server-side as a BCrypt hash, and the platform cannot display it again. If it is lost, generate a new one.

Call the API

Each request carries two headers for authentication:

  • X-App-Key: the AppKey of the credential.
  • X-App-Secret: the AppSecret of the credential.
  • Product list: query products within the credential scope, filterable by name, category and industry.
  • Device list: query devices under a given product, filterable by name and status.
  • Device data: query a given device’s time-series data with a time range and row limit.

NoteOpen API authentication is fully isolated from user login: a leaked credential cannot affect account security inside the platform, and conversely platform accounts cannot call the open API.

Credentials in data screens

  • Data screens read data through a canvas-level credential, using the same credential system.
  • A screen stores only the credential ID, never the secret; the data is fetched through the backend.
  • So even if a screen’s JSON is exported, no secret is exposed.

Security and maintenance

  • One credential per consumer; do not share them, so that problems are easy to trace and revoke.
  • When people change roles or an integration ends, revoke the matching credential and access stops immediately.
  • Grant the minimum necessary product scope instead of selecting everything for convenience.
  • Review the credential list periodically and clean up credentials that have not been used for a long time.