Authentication

Every data request needs an organization-owned API key. Send it only in the x-api-key header.

GET /v1/locks HTTP/1.1
Host: app.myremotely.ai
x-api-key: mr_lock_REPLACE_WITH_YOUR_KEY

The key selects one organization and cannot create a browser session. A key can have these read scopes:

• locks:read permits the lock list and lock detail operations.

• lock-state:read permits a live locked or unlocked state read.

A wrong, expired, or revoked key returns the same 401 problem. This prevents credential details from leaking. A valid key without the required scope returns 403.

Do not put a key in source code, client-side bundles, URLs, screenshots, logs, or support messages. The documentation build contains synthetic keys only. The request playground sends requests directly to MyRemotely and does not use a third-party proxy.