Integration Journey

A professional Frigolive integration spans three separate trust boundaries: the Frigolive Public API, your backend service, and your web or mobile interface. The long-lived client credentials exist only in the backend layer. The interface never knows the Frigolive client secret.

Preparing access

Frigolive — or an authorized customer administrator — creates a credential for the integration. That record decides which real customer accounts are opened, which operations (scopes) are allowed, and, if required, which IP ranges requests are accepted from.

Credentials are created from Settings → API Credentials in the Frigolive panel; the same screen rotates the secret and revokes the credential.

You store the client secret, shown only once, in your own secure vault. A lost secret is never displayed again: a new one is generated and the old one is retired in a controlled way.

While the integration runs

Your backend service exchanges its service identity for a short-lived access token and caches it in memory. It first discovers which accounts the credential can reach. If there is more than one account, every data request states the target account explicitly in the X-Frigolive-Account-ID header.

Frigolive does not simply trust the account id it receives. It re-verifies that the account is on the credential allow-list, that the token carries the required scope, and that the resource genuinely belongs to that tenant. Guessing a device id grants no access.

How your own application connects (BFF pattern)

Your users’ browsers authenticate against your backend with your own session. Which end user may see which device is decided by your authorization layer. The backend fetches the Frigolive data it needs server-to-server and maps it into your product’s own language.

Public API v1 covers accounts, locations, carriers, receivers, alert presets, shipment templates, devices, telemetry, maintenance history, shipments, alarms, reports, and users. Not every integration is granted all of them. Frigolive opens only the accounts and scopes that match the contract and the intended use. After you connect, the API reference marks operations your token is not authorized for.

You can change the device label and the customer-managed measurement and alarm settings, and manage shipments plus their supporting records. IMEI, SIM, firmware, device ownership, production tests, and platform administration are outside the Public API contract.

Pre-production checklist

1. Use separate credentials for development and production.
2. Scrub client secrets from your application logs.
3. De-duplicate token refresh in the background so only one request runs at a time.
4. Honour the wait times returned by rate-limit responses.
5. Add tenant isolation tests to your CI pipeline.
6. Send a unique Idempotency-Key on every POST that creates a record.
7. Attach the acting end user to the audit trail with X-Frigolive-End-User-ID.

Code samples, exact parameters, five backend languages, and the live try-it panel are in the API Reference.