Chatmeter Authentication

generated: '2026-08-13'
method: probed
source: >-
  Live unauthenticated probes of https://live.chatmeter.com/v5 on 2026-08-13. Chatmeter publishes no
  OpenAPI, and both of its API documentation hosts are credential-gated (support.chatmeter.com 401 ->
  Salesforce Community login, apidocs.chatmeter.com 401 with `www-authenticate: Basic`), so the auth
  profile below is read from what the live API itself returns to an anonymous caller.
name: Chatmeter API Authentication
api: Chatmeter API
base_url: https://live.chatmeter.com/v5

summary: >-
  Username/password token exchange. POST /v5/login with a JSON body of {username, password} returns a
  token, which is then sent on every subsequent call in the Authorization header. There is no OAuth 2.0,
  no OIDC discovery document, no self-serve key issuance page, and no public sign-up — credentials are
  provisioned by Chatmeter for an existing tenant.

schemes:
  - id: login-token
    type: http
    scheme: token
    in: header
    header: Authorization
    description: >-
      The value returned by POST /v5/login is placed directly in the Authorization header on subsequent
      requests. Chatmeter's own product documentation describes this as a JSON Web Token; that claim
      could not be independently verified from an anonymous probe because issuing a token requires
      tenant credentials, so the format is recorded as reported, not observed.
    format_reported: JWT
    format_verified: false
    token_endpoint: https://live.chatmeter.com/v5/login
    token_endpoint_method: POST
    token_endpoint_content_type: application/json
    token_request_fields:
      - name: username
        required: true
        evidence: >-
          POST /v5/login with body {} returns HTTP 400 and
          {"error":{"code":"INVALID_JSON","message":{"obj.username":[{"msg":["error.path.missing"]}]}}}
      - name: password
        required: true
        evidence: >-
          Same 400 response names obj.password with error.path.missing.

  - id: sso-login-token
    type: derived-session
    description: >-
      GET /v5/singlesignon/generateLoginToken?username=<user> mints a short-lived login token for an
      existing user, used to hand a browser session to a partner-hosted surface. The route exists and
      answers 400 (missing parameter) rather than 404 to an anonymous caller, so it is present on the
      live API, but its token semantics are not publicly documented.
    endpoint: https://live.chatmeter.com/v5/singlesignon/generateLoginToken

not_supported:
  oauth2: >-
    No oauth2 flow is offered. /.well-known/oauth-authorization-server and
    /.well-known/oauth-protected-resource return 302 to the static app bucket on live.chatmeter.com and
    404 on www.chatmeter.com.
  openid_connect: >-
    No /.well-known/openid-configuration on any Chatmeter host.
  api_keys: >-
    No self-serve API key page, developer dashboard, or key-prefix convention was found on any public
    Chatmeter surface.
  mtls: false
  scopes: >-
    No scope or permission vocabulary is published. Access is governed by the Chatmeter product's own
    user/group/location permission model (see /v5/users/{id}/groups and /v5/users/{id}/locations), which
    is administered in-product rather than declared on the token.

self_serve: false
self_serve_note: >-
  There is no public sign-up for API credentials. Chatmeter is sold annually per location through sales;
  third-party sources place API access in the Premium tier. An integrator cannot obtain a token without
  an active tenant.

observed_responses:
  - request: 'POST https://live.chatmeter.com/v5/login  body {}'
    status: 400
    body: '{"error":{"code":"INVALID_JSON","message":{"obj.password":[{"msg":["error.path.missing"],"args":[]}],"obj.username":[{"msg":["error.path.missing"],"args":[]}]}}}'
  - request: 'GET https://live.chatmeter.com/v5/locations  (no Authorization header)'
    status: 401
    body: '(empty — content-length: 0)'
    note: >-
      The 401 carries no body, no WWW-Authenticate header and no error code, so an agent cannot tell a
      missing token from an expired or insufficiently-privileged one without out-of-band knowledge.

transport_security:
  https_only: true
  hsts: 'max-age=31536000; includeSubDomains'
  headers_observed:
    - x-content-type-options: nosniff
    - referrer-policy: no-referrer
    - permissions-policy: 'camera=(), microphone=(), geolocation=(), encrypted-media=(), payment=(), speaker=(), usb=()'
  gateway: istio-envoy

docs:
  - url: https://support.chatmeter.com/hc/en-us/categories/4465860037275-Chatmeter-API
    status: 401
    note: Redirects to https://support.chatmeter.com/login (Salesforce Experience Cloud community login).
  - url: https://apidocs.chatmeter.com/
    status: 401
    note: 'CloudFront Lambda@Edge HTTP Basic auth (www-authenticate: Basic).'

see_also:
  - conventions/chatmeter-conventions.yml
  - errors/chatmeter-problem-types.yml