Reviewed 05/10/2026

API Keys & External Integrations

Phase 8 — Integrations · OpenFrame Onboarding

Sometimes the integration you need isn't a pre-built connector — it's your own script, a custom dashboard, or another system that needs to talk to OpenFrame directly. That's what API keys are for: they let external code authenticate to OpenFrame's API. This guide covers generating a key, keeping it safe, and where to find the endpoints.

Before you start

• You need an Admin role.
• Know what the key is for (which script or system will use it) so you can name it clearly and set a sensible expiry.

Where it lives

Go to Settings → API Keys Management. You'll see the API Keys page — a table of your existing keys with Name, Status, Key ID, Usage, Created, and Expires, plus two buttons: API Documentation and Create API Key.

Create a key

1. Click Create API Key.
2. API Key Name (required) — name it for what uses it, e.g. Reporting integration or Nightly inventory export. Future-you needs to know which key to revoke if something leaks.
3. Description (optional) — a line on its purpose.
4. Expiration Date (optional) — set one for keys tied to a temporary integration or a vendor; leave blank for a long-lived internal key. Short-lived is safer.
5. Click Create API Key.

Copy the key immediately. Like every good system, OpenFrame shows the full secret once, at creation. Copy it straight into your integration's secret store or password manager. If you lose it, you don't recover it — you delete the key and make a new one.

Using the API

Click API Documentation (top of the API Keys page) — it opens the in-product Swagger reference with the live endpoints, request/response shapes, and authentication details. The API is organized around Devices, Events, Logs, Organizations, and an Integration API for external tools, so you can:

• Pull data on a schedule — export device inventory, events, or logs into your own reporting or dashboards.
• Manage organizations programmatically — read or update your customer records from another system.
• Wire in external tools — use the Integration API endpoints to connect other systems to OpenFrame.

Authenticate each request with the API key you generated (see the API Documentation for the exact scheme — typically a header). Treat the key like a password.

Managing keys

Back on the API Keys table you can see each key's Status and Usage and revoke one you no longer trust. Good hygiene:

• One key per integration, named clearly — so revoking one doesn't break everything else.
• Rotate keys periodically, and immediately if one may have leaked.
• Set expirations on anything temporary.
• Never commit a key to source control or paste it into a ticket/chat.

Quick checklist

• Opened Settings → API Keys Management
• Created a key with a clear name (and expiry if temporary)
• Copied the secret once into a secure store
• Checked API Documentation for the endpoints you need
• Used one key per integration and planned for rotation

What's next

That completes Phase 8 — Integrations — OpenFrame is now wired to your identity provider and open to your own systems via the API. Next is Phase 9 — Security & Access Control, locking down roles, AI guardrails, and audit logging before you go to production.

Based on OpenFrame v0.9.19. API capabilities and the exact endpoints evolve — always check the in-product API Documentation for the current contract.