Chargefox Authentication

generated: '2026-07-27'
method: searched
source: openapi/chargefox-fleets-api-openapi.json
docs: https://app.chargefox.com/developers/docs/getting_started
description: >-
  Chargefox runs two different authentication models across two API surfaces,
  and neither is self-service. The Fleets API uses an opaque HTTP bearer token
  issued by Chargefox to fleet customers on request. The OCPI CPO API uses
  OCPI's own Token authorization scheme, established through the OCPI
  credentials handshake after a commercial roaming agreement. There is no OAuth,
  no OpenID Connect, no API-key console and no signup — probes of
  /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource
  and /.well-known/openid-configuration all returned 404 on 2026-07-27.
summary:
  types:
  - http
  - custom
  api_key_in: []
  oauth2_flows: []
  self_service: false
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  api: chargefox:chargefox-fleets-api
  in: header
  header: Authorization
  format: 'Bearer <token>'
  sources:
  - openapi/chargefox-fleets-api-openapi.json
  applied_to:
  - GET /api/fleets/v1/usage
  - GET /api/fleets/v1/sessions
  - GET /api/fleets/v1/vehicles
  - GET /api/fleets/v1/invoices
  issuance:
    self_service: false
    process: >-
      Chargefox's getting-started page states that a fleet customer interested
      in using the API should speak to a team member or reach out via
      fleetsupport@chargefox.com. No developer portal signup, no key-management
      console and no sandbox key exist.
    contact: fleetsupport@chargefox.com
  token_format: opaque
  rotation: undocumented
  expiry: undocumented
  scopes: none
  docs: https://app.chargefox.com/developers/docs/getting_started
  example_request: >-
    curl --request GET --url
    'https://app.chargefox.com/api/fleets/v1/usage' --header 'Authorization:
    Bearer <token>'
- name: ocpiToken
  type: custom
  scheme: Token
  api: chargefox:chargefox-ocpi-cpo-api
  in: header
  header: Authorization
  format: 'Token <credentials-token>'
  sources:
  - live probe of https://app.chargefox.com/ocpi/cpo/* on 2026-07-27
  evidence: >-
    Anonymous GET of /ocpi/cpo/versions, /ocpi/cpo/2.1.1/,
    /ocpi/cpo/2.1.1/locations, /ocpi/cpo/2.2/, /ocpi/cpo/2.2.1/ and
    /ocpi/emsp/versions each returned HTTP 401 with the response header
    `WWW-Authenticate: Token realm="Application"`. Sibling paths /ocpi/,
    /ocpi/cpo/ and /ocpi/xyz/versions returned 404, confirming the 401 marks a
    real authenticated route rather than a blanket wall.
  issuance:
    self_service: false
    process: >-
      OCPI credentials are exchanged in the specification's own credentials
      module handshake once a roaming agreement is in place. Chargefox publishes
      roaming partner terms and conditions rather than a developer signup.
    terms: https://www.chargefox.com/legal/roaming-partner-terms-and-conditions
    partners: https://www.chargefox.com/partners
  specification: https://github.com/ocpi/ocpi
  scopes: none
discovery:
  well_known_probed: well-known/chargefox-well-known.yml
  oauth_authorization_server: 404
  oauth_protected_resource: 404
  openid_configuration: 404
  security_txt: '403 (app.chargefox.com) / 404 (www.chargefox.com)'