ChargeIndia Hub Docs

Authentication

How to authenticate OCPI requests to and from ChargeIndia Hub.

All OCPI requests to ChargeIndia Hub require authentication unless explicitly noted otherwise.

Request authentication

Include the OCPI credentials token in every request. Per OCPI 2.2.1, the header value is Base64(UTF-8(raw-token)) (RFC 4648):

Authorization: Token {base64-utf8-of-your-token}

Example: if the Credentials exchange gave you the raw token example-token, send:

Authorization: Token ZXhhbXBsZS10b2tlbg==

Store the raw token from credentials exchange securely. Treat it as a secret comparable to an API key. Only Base64-encode it when placing it in the Authorization header.

Legacy raw headers

The Hub also accepts the raw (non-Base64) token in the Authorization header for compatibility with older OCPI 2.1.1 / 2.2 partners. New integrations should send Base64 as required by OCPI 2.2.1.

Auth on all OCPI routes

ChargeIndia Hub requires authentication on all /ocpi/* routes, including GET /ocpi/versions. This differs from some OCPI implementations that expose versions without auth.

Tracing headers

The Hub accepts optional tracing headers:

HeaderPurpose
X-Request-IDUnique ID for this request
X-Correlation-IDID linking related requests across parties

If omitted, the Hub generates values automatically. Include them in your logs for support investigations.

Response envelope

All Hub responses use the standard OCPI envelope:

{
  "status_code": 1000,
  "status_message": "Success",
  "timestamp": "2025-06-23T10:00:00.000Z",
  "data": { }
}
status_codeMeaning
1000Success
2000Generic client/server error
2002Unauthorized (invalid or suspended party)
2003Not found
2004Rate limit exceeded

Suspended parties

If your party account is suspended, all authenticated requests return 401 with status_code: 2002. Contact your account team to resolve.

Outbound calls (Hub → your platform)

When the Hub calls your OCPI endpoints, it uses the raw token you provided during credentials exchange, Base64-encoded in the header per OCPI 2.2.1:

Authorization: Token {base64-utf8-of-token-you-provided}

Your platform must validate by decoding Base64 (or matching raw for legacy) against the token from the Credentials object.

Unauthenticated endpoints

The only Hub OCPI endpoint that does not require authentication is:

POST /ocpi/2.2.1/commands/callback/{command_id}

This is called by CPOs to deliver async command results. The Hub validates the callback using the command context, not a bearer token.