Authentication
Get an event-read key
Use with AI
Event history, streams, and snapshots require an events:read API key. This credential is separate from website sign-in and your product license.
1. Create the key in Watch
- In Watch, open API & Integrations → Settings. Enable the local network connection and select the network used by the integration computer.
- Under Connection key, select Create API key. Ask the local administrator for help if you cannot access it.
- Copy the complete key when it is shown; it is displayed only once. Save it in a local secret manager or the integration’s secret store. The interface shows its expiry date.
If an administrator supplies an existing Event API, request its address and event-read key. You do not need another deployment or an administrative API key.
2. Confirm event access
Enter the key in Watch’s built-in event viewer. A connected status confirms authentication; an empty event list is valid. Programmatic integrations send the following header on each request. Do not put the key in the URL.
Authorization: Bearer <event-read-api-key>Follow the quickstart connection checks
If authentication fails
- 401: check locally for a truncated, expired, or revoked key.
- 403: ask the administrator to check events:read access and whether the computer is on the allowed LAN.
- 404: check the API path first. A more privileged key does not add operations to a read-only endpoint.
Replace or revoke a key
Create a replacement under Connection key, update the integration, and verify a read before selecting Disable & delete for the old key. Disable a compromised key immediately. Manage keys locally in Watch; the public Event API does not provide key-management operations.
After revocation or expiry, the next event or image request is reauthenticated. An SSE connection closes at its next authorization check, which may not be immediate. Stop retrying on 401 or 403 and ask the administrator to review access.