Authentication

Every request to Ubidots requires a token. A token is a unique key that authorizes requests sent to Ubidots.

Get an API token

There are two ways to get an API token:

1. In your account

The API token is found under the My Profile section on industrial.ubidots.com:

2. Through the API

A more secure way is to implement logic in your device, gateway, or external application to generate temporary tokens before each request, using your account's API key. Your API key can also be found in your account's "My Profile" section.

To generate tokens, make a request to this endpoint:

Request

Headers

Sample response

{
    "token": "BBFF-nQ5jCC445FfClcKLCQ55YhnTb2oh6knHsZO55JAvogLSrcHK7WxoPJU"
}

More information on how to obtain your token.

Using your token in API requests

There are two ways to send a token in a request:

1. Sending the token in the header (recommended):
   X-Auth-Token=token

2. Sending the token as a query parameter:
   ?token=token

While sending your token as a query parameter might be more straightforward, we recommend doing so only during prototyping because the token is visible and therefore much less secure. In production, we strongly recommend sending the token in the X-Auth-Token header.

🚧

Authentication without a header - Not recommended!

While it is possible to send the authentication token as a query parameter without the X-Auth-Token header, it is much less secure. Including a token — or any security credential — in a URL path will make it easily readable in router logs, browser history, and packet sniffers.

// Example request to create a device with the token in the header

curl -X POST 'https://industrial.api.ubidots.com/api/v2.0/devices/' \
 -H 'Content-Type: application/json' \
 -H 'X-Auth-Token: oaXBo6ODhIjPsusNRPUGIK4d72bc73' \
 -d '{}'
 
 
 // Example request to get all devices with the token sent as a query parameter
 
 curl -X GET 'https://industrial.api.ubidots.com/api/v2.0/devices/?token=asdf657asdf675asdf876asdf' \