Authentication

API key

Every request needs your key in the x-api-key header:

x-api-key: YOUR_API_KEY

Keys are environment-specific — your cert key won't work against production and vice-versa.

IP allow-listing

In addition to a valid key, your calling IP address must be allow-listed. Provide the stable outbound/egress IP(s) of your backend (not office or user IPs) to your partner manager. Behind a NAT, load balancer, or cloud provider, use the egress range; CIDR ranges are fine.

A request with a missing/invalid key or a non-allow-listed IP returns HTTP 403. If you're getting 403 with a key you believe is valid, check the IP allow-list first.

Environments

Environment	Endpoint	Use
Certification (sandbox)	https://eapi.cert.powerhq.co/graphql	Build & test
Production	https://eapi.prod.powerhq.co/graphql	Live traffic

The legacy https://eapi.energybot.com/graphql endpoint continues to work during the migration; point new integrations at powerhq.co.

Keep your key server-side

Your x-api-key grants access to the API. Call PowerHQ from your backend and never expose the key in client-side code. Your frontend should call your server, which calls PowerHQ. The example app shows this pattern with a minimal proxy.

Browser ──▶ your server ──(x-api-key)──▶ PowerHQ API

Errors

• 403 — missing/invalid key, or a non-allow-listed IP.
• 400 — malformed request.
• 200 with an errors[] array — a valid request that failed validation (e.g. a bad ZIP). GraphQL returns these in the body, not as an HTTP error:

{ "errors": [ { "message": "Invalid zipcode 1234" } ], "data": null }

Rate limits

Usage is throttled per key. If you hit limits you'll receive 429; back off and retry. Contact your partner manager for your plan's specific limits.