Create your first CHeKT App.

Before you start

Four things to have on hand. None are blockers — you can grab any you're missing as you go.

• Admin access to dealer.chekt.com
• A secret manager — 1Password, Doppler, AWS Secrets, or just a .env file
• Decided which permissions you need (or starting small)
• Public HTTPS endpoint ready (if your app needs webhooks)

The full flow at a glance

Six steps from the admin's first click to your app making its first call.

1 Open the apps page

Sign into dealer.chekt.com with an admin account. Open Settings → CHeKT Apps from the left sidebar, then click New app in the top-right.

2 Name your app

The name shows up in audit logs, webhook delivery history, and the dealer's installed-apps list. Pick something specific so operators reading the log six months from now still know what the app does.

3 Pick permissions

Grant only what the app needs. You can expand permissions later — the dealer admin re-approves the new set — and you can tighten permissions silently any time. The principle of least privilege keeps your blast radius small if the key ever leaks.

The picker

The dealer portal lays out scopes by resource family. Click each one to toggle it on.

Quick recipes

Common app shapes and the scopes they typically need. Pick the closest match and trim.

4 Subscribe to webhook events

If your app needs real-time push from CHeKT, register a webhook URL and pick events to subscribe to. Skip this step if your app only reads via the REST API — you can add webhooks later from the same settings page.

Webhook URL

A public HTTPS endpoint you control. CHeKT POSTs each event here with a signed header. For local development, use a tunnel like ngrok or cloudflared.

ngrok http 3000
# → forwarding https://abc123.ngrok.app → http://localhost:3000

# Paste the https://… URL into the webhook field in the portal.

Selecting events

The fewer events you subscribe to, the cleaner your delivery log. Start with the two or three event types driving your core workflow.

See the event catalog for every event type with its payload shape and required permission scope.

5 Save the API key & signing secret

When you click Create, CHeKT shows your API key and webhook signing secret on screen. Copy them now.

Where to store them

Local dev

A .env file in .gitignore. Never commit. Use a library like dotenv to load.

Production servers

Your platform's secrets manager — AWS Secrets Manager, GCP Secret Manager, Vault, Doppler.

CI/CD pipelines

Encrypted secrets store — GitHub Actions secrets, GitLab variables, Vercel env vars.

Anywhere else

A dedicated secrets manager that audit-logs reads. 1Password Teams, Bitwarden Business, Doppler.

6 Verify with your first API call

List the devices on your dealer. A successful response confirms auth, permissions, and connectivity all work end-to-end. Pick your language:

export CHEKT_API_KEY='chekt_live_8h2j3kfm…'

curl https://api.chekt.com/v1/devices \
  -H "Authorization: Bearer ${CHEKT_API_KEY}" \
  -H "Accept: application/json"

A successful response looks like this:

{
  "data": [
    {
      "id": "dev_8h2j3kfm",
      "type": "camera",
      "name": "Main Entrance",
      "site_id": "site_29snd",
      "status": "online",
      "firmware": "2.14.1"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

If you see an error

Most first-call errors fall into one of four buckets:

Bonus — set up the webhook handler

If you subscribed to webhooks in step 4, here's the minimal receiver. Always verify the HMAC signature against the raw bytes (not the parsed JSON) and respond with 200 within 30 seconds.

import express from "express";
import crypto from "crypto";

const app = express();

app.post(
  "/webhooks/chekt",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.headers["x-chekt-signature"] as string;
    const ts  = req.headers["x-chekt-timestamp"] as string;
    const signed = `${ts}.${req.body.toString("utf8")}`;

    const expected = crypto
      .createHmac("sha256", process.env.CHEKT_WEBHOOK_SECRET!)
      .update(signed)
      .digest("hex");

    if (!crypto.timingSafeEqual(
      Buffer.from(sig, "hex"),
      Buffer.from(expected, "hex"),
    )) return res.status(401).end();

    const event = JSON.parse(req.body.toString("utf8"));
    console.log(`Got ${event.type}`);
    res.sendStatus(200);
  },
);

app.listen(3000);

You're done.

You have a working CHeKT App with an API key, scoped permissions, and (optionally) webhook delivery. From here:

• Explore the API surface120+ endpoints across devices, alarms, sites, snapshots.
• Production-ready webhook handlingSign verification, dedupe patterns, retry policy.
• Build something realEnd-to-end AI verification walkthrough.
• Lock down the blast radiusIP allow lists, key rotation, incident response.
• Try the Operator CLIDrive the same API from the terminal.
• Plug into Claude or ChatGPTRun your app through an LLM agent.