Generate or rotate the API key

POST

/auth/apikey

const url = 'https://demo.evcc.io/api/auth/apikey';
const options = {
  method: 'POST',
  headers: {cookie: 'auth=<auth>', 'Content-Type': 'application/json'},
  body: '{"password":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://demo.evcc.io/api/auth/apikey \
  --header 'Content-Type: application/json' \
  --cookie auth=<auth> \
  --data '{ "password": "example" }'

Generates a fresh API key, replacing any existing one. The returned key is shown only once; store it immediately.

Even when the request is authenticated via API key (Bearer), the admin password must be supplied in the request body to prevent a leaked key from rotating itself. The password check is skipped when the server is started with --disable-auth.

Authorizations

cookieAuth
bearerAuth

Request Body^required

application/json

object

password

Admin password

string

Example^generated

{
  "password": "example"
}

Responses

200

Success

application/json

object

key

The new API key (cleartext, shown once).

string

Example

{
  "key": "evcc_aB3xYz7k0Pq2sN5mWtR4"
}

401

Invalid admin password

403

Forbidden in demo mode