Authentication
Create a Platform API token, send it with each request, and rotate it before it expires.
The Platform API authenticates each request with a personal API token. The token acts as you: it can read the sites your DUET account can open, and nothing more.
Create a token
- In the DUET app, click your avatar, and then click User Settings.
- In the API access section, click Generate token.
- Click Copy token, and store the token somewhere safe, such as a secrets manager.
Each DUET user has one token. Treat it like a password: anyone with the token can read your data.
Send the token
Send the token in the Authorization header of every request, as a bearer token:
curl https://api.enurgen.com/platform/v1/projects \
-H "Authorization: Bearer $DUET_API_TOKEN"What a token can access
- Read endpoints return data for the sites your DUET account can open.
- Ingest endpoints require permission to edit the site.
- A request for a site your account can't open returns
403 Forbidden.
If your access in DUET changes, your token's access changes with it.
Expiry and rotation
A token expires 90 days after you create or rotate it. The API access section shows the expiry date, and warns you when it's 14 days away.
To rotate a token:
- In the API access section, click Rotate.
- Click Rotate token to confirm.
- Copy the new token, and update every script and integration that uses the old one.
Rotating revokes the old token immediately. Requests that use it fail until you update them.
A request with an expired token returns 401 Unauthorized, with a message that says when the token expired.
Inbound sync credentials
The inbound sync endpoints, which send changes from your maintenance system to DUET, use separate credentials scoped to your organization or one site. To get them, contact your account manager.