Open a lock with a temp-key PIN
Unauthenticated endpoint for a connected entrance panel. Verifies the submitted PIN against the live temp keys covering this lock and, on success, opens the door exactly as the guest page slide-to-open does. Every refusal — wrong PIN, unknown PIN, a lock the key does not cover, revoked, expired, not yet valid — returns the identical 401 so the endpoint is not an enumeration oracle. Repeated failures are throttled and then locked out per lock (429 with Retry-After).
curl -X POST "https://api.spkey.co/locks/123/open-with-pin" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN (JWT)" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"pin": "example_string"
}'
import requests
import json
url = "https://api.spkey.co/locks/123/open-with-pin"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN (JWT)",
"X-API-Key": "YOUR_API_KEY"
}
data = {
"pin": "example_string"
}
response = requests.post(url, headers=headers, json=data)
print(response.json())
const response = await fetch("https://api.spkey.co/locks/123/open-with-pin", {
method: "POST",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN (JWT)",
"X-API-Key": "YOUR_API_KEY"
},
body: JSON.stringify({
"pin": "example_string"
})
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
"bytes"
"encoding/json"
)
func main() {
data := []byte(`{
"pin": "example_string"
}`)
req, err := http.NewRequest("POST", "https://api.spkey.co/locks/123/open-with-pin", bytes.NewBuffer(data))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN (JWT)")
req.Header.Set("X-API-Key", "YOUR_API_KEY")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://api.spkey.co/locks/123/open-with-pin')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN (JWT)'
request['X-API-Key'] = 'YOUR_API_KEY'
request.body = '{
"pin": "example_string"
}'
response = http.request(request)
puts response.body
{
"success": true,
"offline": true
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Too Many Requests",
"message": "Rate limit exceeded. Please try again later",
"code": 429,
"retryAfter": 3600
}
{
"error": "Internal Server Error",
"message": "An unexpected error occurred on the server",
"code": 500,
"requestId": "req_1234567890"
}
{
"error": "Service Unavailable",
"message": "The service is temporarily unavailable. Please try again later",
"code": 503
}
/locks/{id}/open-with-pinTarget server for requests. Edit to use your own host.
JWT token from SmartphoneKey authentication. Identifies the B2C user or B2B service.
API key for B2B organization access. Provided during organization onboarding.
Lock ID (numeric)
The media type of the request body
The PIN issued with the temp key (always 6 digits today)
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token (JWT). JWT token from SmartphoneKey authentication. Identifies the B2C user or B2B service.
API Key for authentication. API key for B2B organization access. Provided during organization onboarding.
Path Parameters
Lock ID (numeric)
Body
The PIN issued with the temp key (always 6 digits today)
Responses
The device was offline; the unlock is queued on its shadow. The command was still accepted.