Skip to main content
Everything the public API does authenticates with one credential: an API key beginning with cdojo_. Keys are created in the app, never through the API.

Prerequisites

  • The Integrate plan or above. The free tier is for interactive evaluation in the browser; it cannot create API keys. See Plans and pricing.
  • Sign in as an Admin or Owner of the organisation that will own the key.

Create the key

  1. Sign in at chargerdojo.com.
  2. Open the Credentials tab of Settings.
  3. Choose Create key and give it a name that says where it will be used, such as github-actions-roaming-ci. The name is how you will recognise it at revocation time.
  4. Copy the key.
The plaintext key is shown once, at creation. It is not retrievable afterwards: the app lists only the key’s name, prefix and metadata. If you lose it, revoke it and create a new one.

Store it like a secret, because it is one

Put the key straight into a secret manager (GitHub Actions secrets, GitLab CI variables, Vault, AWS Secrets Manager) and expose it to jobs as an environment variable:
Then reference only the variable in scripts: Operation reference: GET /usage.
Rules that prevent the common leaks:
  • Never commit a key, paste it into a ticket, or hardcode it in a script.
  • Never echo the key or pass it as a command-line argument that lands in shell history or CI logs. Read it from the environment.
  • Give each pipeline its own key, so revoking one does not break the others.

Rotate and revoke

Rotation is create-then-revoke:
  1. Create a new key in Settings, then Credentials.
  2. Update the secret in your CI store.
  3. Revoke the old key from the same page.
Revocation is immediate: requests with a revoked key start returning 401. Revoke a key the moment you suspect it leaked; creating its replacement takes seconds. Each organisation shares a cap of 10 active keys across its members. The cap is the same on every plan, and revoking one frees its slot at once. Your organisation’s current count is in GET /api/v1/usage alongside the cap.

There is no key-management API, deliberately

Creating, listing and revoking keys requires your signed-in browser identity. A cdojo_ key cannot mint another key, list your keys, or revoke one. This keeps a leaked CI key from quietly granting itself successors.

Next

To fail a GitHub build on a broken OCPI rule, follow the four steps in On GitHub Actions. To try the API by hand first, run your first conformance run from the command line.