Chargefox · Authentication Profile

Chargefox Authentication

Authentication

Chargefox runs two different authentication models across two API surfaces, and neither is self-service. The Fleets API uses an opaque HTTP bearer token issued by Chargefox to fleet customers on request. The OCPI CPO API uses OCPI's own Token authorization scheme, established through the OCPI credentials handshake after a commercial roaming agreement. There is no OAuth, no OpenID Connect, no API-key console and no signup — probes of /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource and /.well-known/openid-configuration all returned 404 on 2026-07-27.

Chargefox secures its APIs with http and custom across 2 declared security schemes, as derived from its OpenAPI definitions.

EnergyAustraliaEV ChargingElectricityUtilitiesOCPICharge Point OperatorRoamingFleetsMobilityCharging SessionsElectrification

Methods: http, custom Schemes: 2 OAuth flows: API key in:

Security Schemes

bearerAuth http

scheme: bearer · in: header ()

ocpiToken custom

scheme: Token · in: header ()

Source

Authentication Profile

generated: '2026-07-27'
method: searched
source: openapi/chargefox-fleets-api-openapi.json
docs: https://app.chargefox.com/developers/docs/getting_started
description: >-
  Chargefox runs two different authentication models across two API surfaces,
  and neither is self-service. The Fleets API uses an opaque HTTP bearer token
  issued by Chargefox to fleet customers on request. The OCPI CPO API uses
  OCPI's own Token authorization scheme, established through the OCPI
  credentials handshake after a commercial roaming agreement. There is no OAuth,
  no OpenID Connect, no API-key console and no signup — probes of
  /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource
  and /.well-known/openid-configuration all returned 404 on 2026-07-27.
summary:
  types:
  - http
  - custom
  api_key_in: []
  oauth2_flows: []
  self_service: false
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  api: chargefox:chargefox-fleets-api
  in: header
  header: Authorization
  format: 'Bearer <token>'
  sources:
  - openapi/chargefox-fleets-api-openapi.json
  applied_to:
  - GET /api/fleets/v1/usage
  - GET /api/fleets/v1/sessions
  - GET /api/fleets/v1/vehicles
  - GET /api/fleets/v1/invoices
  issuance:
    self_service: false
    process: >-
      Chargefox's getting-started page states that a fleet customer interested
      in using the API should speak to a team member or reach out via
      fleetsupport@chargefox.com. No developer portal signup, no key-management
      console and no sandbox key exist.
    contact: fleetsupport@chargefox.com
  token_format: opaque
  rotation: undocumented
  expiry: undocumented
  scopes: none
  docs: https://app.chargefox.com/developers/docs/getting_started
  example_request: >-
    curl --request GET --url
    'https://app.chargefox.com/api/fleets/v1/usage' --header 'Authorization:
    Bearer <token>'
- name: ocpiToken
  type: custom
  scheme: Token
  api: chargefox:chargefox-ocpi-cpo-api
  in: header
  header: Authorization
  format: 'Token <credentials-token>'
  sources:
  - live probe of https://app.chargefox.com/ocpi/cpo/* on 2026-07-27
  evidence: >-
    Anonymous GET of /ocpi/cpo/versions, /ocpi/cpo/2.1.1/,
    /ocpi/cpo/2.1.1/locations, /ocpi/cpo/2.2/, /ocpi/cpo/2.2.1/ and
    /ocpi/emsp/versions each returned HTTP 401 with the response header
    `WWW-Authenticate: Token realm="Application"`. Sibling paths /ocpi/,
    /ocpi/cpo/ and /ocpi/xyz/versions returned 404, confirming the 401 marks a
    real authenticated route rather than a blanket wall.
  issuance:
    self_service: false
    process: >-
      OCPI credentials are exchanged in the specification's own credentials
      module handshake once a roaming agreement is in place. Chargefox publishes
      roaming partner terms and conditions rather than a developer signup.
    terms: https://www.chargefox.com/legal/roaming-partner-terms-and-conditions
    partners: https://www.chargefox.com/partners
  specification: https://github.com/ocpi/ocpi
  scopes: none
discovery:
  well_known_probed: well-known/chargefox-well-known.yml
  oauth_authorization_server: 404
  oauth_protected_resource: 404
  openid_configuration: 404
  security_txt: '403 (app.chargefox.com) / 404 (www.chargefox.com)'

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/chargefox-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.