Authentication

The Optra API supports two authentication methods: API Keys for server-side integrations and OAuth 2.0 for user-delegated access. All requests must be made over HTTPS.

API Keys

API keys are long-lived credentials tied to your organisation. Pass the key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Generate an API key from the Optra platform under Settings → API Keys. Keys can be scoped to specific permissions and revoked at any time.

OAuth 2.0

For acting on behalf of a user, use the OAuth 2.0 client credentials flow:

POST https://auth.optraiot.lexmark.com/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&scope=devices:read telemetry:read

The response contains an access_token valid for 3600 seconds. Use it identically to an API key in the Authorization header.

Security Best Practices

• Never expose API keys in client-side code or public repositories.
• Rotate keys regularly and immediately if suspected compromised.
• Use the minimum required scopes for each integration.
• Store secrets in environment variables or a secrets manager — not in source code.