How to authenticate requests to Shure System API Server?

January 17, 2024

When I make a request to get my devices, I don’t see them. I only see an HTTP 401 unauthorized response each time. How can I authenticate my requests?

My HTTP client code:

curl -X 'GET' \
  'https://localhost:10000/api/v1/devices' \
  -H 'accept: application/json'

The HTTP response:

{
  "type": "",
  "title": "Request Unauthorized.",
  "status": 401,
  "detail": "",
  "instance": "",
  "traceId": "2c689426-ec2d-4ba6-8c14-e6d173ba450e"
}

>Solution :

From https://Shure.stoplight.io:

Overview

Each call to System API must be authorized. This is accomplished by
the use of a shared secret, which is sent with each HTTP request.
System API will generate this secret for you.

REST API Authorization

All HTTP requests to the System API require
authorization. If this is not provided, the result will be HTTP 401
Unauthorized, indicating that the shared secret must be included in
requests.

The shared secret is an API key which is generated when System API
runs for the first time. This key is found at
C:\ProgramData\Shure\SystemAPI\Standalone\Security\sharedkey.txt.

Shared Secret File Permissions on Windows

When you install System API,
the user account of the user who ran the installer will be added to a
group which has read access to the shared secret file. This group will
be labeled ShureSystemAPI, and you can manage it by running lusrmgr
from a command prompt.

You will need to set the shared secret as the value for the HTTP
header x-api-key for each API request you make.

Protect Your Shared Secret

It is your responsibility to make sure the shared secret does not fall into the wrong hands. Anybody who obtains the secret key and has access to your server can use the API without restriction!