Skip to main content
Settings → Credentials holds everything a client needs to talk to your deployment: API keys for the REST API and application credentials for the Mobile SDK. The tab also shows the API Base URL of the deployment with a copy button.

​
API Keys

API keys authenticate requests to the REST API through the X-Open-Wearables-API-Key header and are used to embed widgets. See Authentication for how to send them.
  • Create API Key - give the key a name. The dialog then shows the full key with a copy button. The name is only a label, you can change it later.
  • The key is shown only once. Open Wearables stores a hash of the key, so it cannot be retrieved later. The table shows just a short prefix (for example sk-a1b2c3d…) to help you tell keys apart. If you lose a key, rotate it.
  • Rotate - generates a new key under the same name and shows it once. The previous key stops working immediately, so update every integration that used it.
  • Rename - update the display name of a key.
  • Delete - the key stops working immediately for every integration that uses it.
Send the key in the X-Open-Wearables-API-Key header of every request:
A missing or invalid key returns 401 Unauthorized. See Authentication for response formats and status codes.

​
Keys are shared across the deployment

API keys belong to the deployment, not to the developer who created them. Every developer sees all keys and can create, rotate, rename, and delete any of them, including keys created by someone else. The created by attribute is audit information only. It does not grant ownership and does not restrict what other developers can do with the key. See Team for the full access model.

​
Applications

Applications are the credentials used by the Mobile SDK. Each registered app gets an app_id and an app_secret.
  • Create Application - give the app a name, for example “My iOS App”. The dialog then shows the App ID and the App Secret.
  • The secret is shown only once. Store it in your backend environment right away. If you lose it, rotate the secret and update your backend.
  • Rotate secret - generates a new secret and shows it once. The previous secret stops working immediately.
  • Delete - removes the application. SDK clients using its credentials can no longer authenticate.
Keep the app secret on your backend. Never ship it inside a mobile app binary or expose it in client-side code.