Authentication

Every data request needs an organization-owned API key. Set the base URL for the environment that issued the key and send the key only in the x-api-key header.

export MYREMOTELY_BASE_URL='https://app.myremotely.ai'
export MYREMOTELY_API_KEY='mr_lock_REPLACE_WITH_YOUR_KEY'

curl --fail-with-body \
  --header "x-api-key: $MYREMOTELY_API_KEY" \
  "$MYREMOTELY_BASE_URL/v1/locks"

The key selects one organization and cannot create a browser session. A key can have these read scopes:

• locks:read permits the lock list, lock detail, live locked or unlocked state, lock brand, connector, code-runway and tour-message-text reads. The old scope lock-state:read is gone: a key that has only that scope cannot read the live state.

• locks:write permits the read of how the last door-code update of a unit went.

• locks:assign permits the read of the codes an unbind could revoke.

• units:write permits the unit reads: blackout ranges, a timezone-change preview, pre-screening, and open-house RSVPs and hosts.

• tours:read permits the tour reads.

• tours:write permits the read of the free times a tour can move to.

• inquiries:read permits the read of one inquiry.

• messages:read permits the message-template and unread-count reads.

• phone:call permits the read of the call history.

• users:read permits the user, role and permission reads.

• settings:read permits the settings, listing-switch and billing reads.

• settings:write permits the read of how the organization routes inbound calls.

Every operation names the one scope it needs. A scope opens reads only: no operation on this API changes anything.

A wrong, expired, or revoked key returns the same 401 problem. This prevents credential details from leaking. A valid key without the required scope returns 403.

When an administrator creates a key, they choose 30 days, 90 days, 1 year, a custom duration from 1 to 3650 days, or Never expires. Never-expiring keys are still organization-scoped, revocable, and rate-limited.

Do not put a key in source code, client-side bundles, URLs, screenshots, logs, or support messages. The documentation build contains synthetic keys only. Use the executable cURL and TypeScript examples in these guides; there is no environment-bound request playground.