Server-side keys only
Do not embed EnergyNetWatch API keys in browser JavaScript, mobile apps, public repositories, screenshots, prompts, or shared documents.
API security and usage
Secure API Access for Oil and Gas Data Workflows
EnergyNetWatch API access is designed for approved server-side integrations. Keys are scoped, usage is metered, requests are traceable, and protected endpoints fail closed when credentials or entitlements are not valid.
Scoped access
Keys are limited by account entitlement, approved endpoint scopes, usage limits, and commercial use case.
Revocation and rotation
Revoke keys when an integration changes owner, when a device is lost, or when exposure is suspected. Create a replacement key after updating the destination environment.
Request logging
Log request ids, status codes, and endpoint names. Do not log full keys, customer secrets, or exported sensitive credentials.
Redistribution review
Public resale, redistribution, or customer-facing product use should be approved before launch.
AI workflow safety
AI agents should receive environment-based credentials and should not ask users to paste real API keys into prompts.
Fail-closed behavior
Integrations should handle authentication, entitlement, credit, and rate-limit failures explicitly.
No key
401 UnauthorizedRevoked or paused key
401 UnauthorizedValid key without endpoint scope
403 ForbiddenNo active entitlement
403 ForbiddenIncluded and prepaid units exhausted
402 Prepaid credits requiredRate window exhausted
429 Rate limit exceededIntegration checklist
- Use a managed secret store or environment variable for ENERGYNETWATCH_API_KEY.
- Run a bogus-key smoke test and confirm protected endpoints fail with 401.
- Confirm the integration handles 402, 403, and 429 without looping.
- Keep source dates, coverage notes, and caveats in downstream displays.
- Use X-Request-ID in support tickets instead of sending raw credentials.
- Review redistribution rights before embedding results in a public product.