Skip to navigation

Authentication

Every request carries a bearer token that expires, or a browser sign-in from the CLI or an MCP client.

The EV Cloud API, SDKs, CLI and MCP server accept the same credential:

Authorization: Bearer <token>

SDK tokens

Use an SDK token for code, scripts and CI. EV Cloud accepts an SDK token only if it expires (it carries an exp claim): EV Cloud keeps no database, so it cannot check whether a token without an expiry was revoked. A token without one gets 401 invalid token.

Store the token in your secret manager or an environment variable:

export EVCLOUD_TOKEN="<token>"

When a token leaks, it keeps working until it expires: issue short-lived tokens and rotate them.

Never commit a token. Read it from EVCLOUD_TOKEN or your secret manager.

Browser sign-in (OAuth)

The CLI can sign you in with your OCPPLab account instead of a token: evcloud-cli auth login opens your browser, you choose the organization and select Allow. The CLI stores and refreshes its own access. See evcloud-cli.

MCP clients such as Claude and Cursor use the same sign-in: add the /mcp URL and the client opens your browser on the first call. See MCP server.

What a token can see

  • Organization: every result is scoped to the token’s organization. An id from another organization returns 404.
  • Role: admin-only operations, such as removing an OCPI partner, return 403 unless the token belongs to an organization admin.

Use the token

import { EvcloudSDK } from "evcloud-sdk";
const client = new EvcloudSDK({
    environment: "https://api.ev-cloud.ai",
    token: process.env.EVCLOUD_TOKEN!,
});