Insights uses an API key sent in a request header. Keys do not expire, there is no token exchange, and nothing needs refreshing on a timer. This is the scheme to build on, and the one Try it uses on every endpoint page.A second, older scheme also still works: signing in with a username and password to obtain a bearer token. It is deprecated and documented at the foot of this page for existing integrations only.All requests must be made over HTTPS. Requests over HTTP are not processed.
When you are onboarded you receive an email with a username and password for the account service. That is where keys are created and managed.
1
Sign in to the account serviceGo to account.polestarglobal.com. Regular users land on their Profile page. Admin users land on Organisation Account Details instead, so click Profile in the bottom-left corner first.
2
Open the API Keys tabOn your profile, switch from Details to API Keys.
3
Add a new keyClick Add new key, give it a descriptive name, and copy the key immediately. It is shown once and cannot be retrieved afterwards.
Use one key per integration
Create a separate key for each project, initiative or integration instead of sharing one everywhere. When something needs revoking, you can cut off that one use and leave the rest running.
Reset your password from your Profile Settings in the Account Service UI.The Security section contains a "Reset Password" button. Clicking on this button will send a One Time PAsscode (OTP) to your registered email address. Enter this code and your new password to update it.
This flow is deprecated. Integrations already using it keep working and nothing is being switched off, but do not use it for anything new.Two practical reasons. An API key never expires, while an access token lasts an hour and needs refresh logic wrapped around it. The signin flow also requires you to store a username and password, which an API key does not.
These endpoints are not published in the API reference, deliberately, so there is no Try it for them. The detail below is what you need to use them.
Signing in
Post a username and password to the signin endpoint.
A successful response returns Access-Token and Refresh-Tokenheaders, plus the user's details in the body: the user id, name, email, role and account id.
Token
Validity
Used for
Access token
1 hour
Every API request
Refresh token
30 days
Obtaining a new access token
If the account has MFA enabled, the response looks different. See below.
