Secure HTTP-only cookie. State-changing browser requests require CSRF.
CURRENT PRODUCTION CONTRACT
HomeAutoPro API
A curated path through the production REST, realtime and webhook interfaces. Interactive OpenAPI remains available as the canonical advanced schema.
GETTING STARTED
From credentials to realtime.
- 1Create an accountVerify the owner identity and sign in.
- 2Create API credentialsSave the one-time API Secret locally.
- 3List devicesCall the owner-scoped
GET /api/devices. - 4Read or command stateValidate against the selected template.
- 5Subscribe to realtimeUse the owner or device WebSocket.
- 6Configure webhooksVerify every signed raw payload.
Authentication boundaries
X-API-Key plus X-API-Secret. Responses stay owner-scoped.
X-Device-Secret for REST, or the first WebSocket auth message.