WhatPulse Authentication: API Access & Security (2026)

Authentication overview

WhatPulse provides a system for tracking user activity, including keyboard, mouse, and network usage. While its primary interface is a desktop client and web dashboard, premium users can access an API to programmatically retrieve their personal statistics. Authentication for the WhatPulse API is managed through API keys, which serve as tokens to verify the identity and authorization of a requesting application or script. The desktop client, conversely, authenticates users directly with their registered username and password upon login.

The API key model is a common approach for developers seeking to integrate their applications with external services. It allows for direct authorization of requests without requiring user interaction for each API call. The WhatPulse API key grants access to the data associated with the user account that generated the key, ensuring that only authorized applications can retrieve personal statistics. This separation of concerns means that while users interact with WhatPulse via their login credentials, programmatic access relies on a distinct, revocable key.

Secure handling of these API keys is critical, as compromise could lead to unauthorized access to personal usage data. WhatPulse emphasizes the importance of treating API keys as sensitive credentials, similar to passwords, and recommends adherence to standard security practices when storing and transmitting them.

Supported authentication methods

WhatPulse supports distinct authentication methods depending on the interface being used:

• API Key (for API access): This method is used for programmatic interactions with the WhatPulse API. A unique, secret key is generated by the user through their WhatPulse web dashboard. This key is included in API requests to authenticate the caller and authorize access to their specific data. API keys are suitable for server-to-server communication or applications where a single user's data is being accessed.
• Username and Password (for desktop client and web dashboard): This is the standard credential-based authentication used when a user logs into the WhatPulse desktop client or the web dashboard. Users provide their registered username and password, which are verified against WhatPulse's user database. This method establishes a user session for direct interaction with the WhatPulse platform.

The following table summarizes the authentication methods, their typical use cases, and their general security levels:

Getting your credentials

The process for obtaining credentials depends on whether you need API access or are simply logging into the client or web interface:

For API Keys (Premium Users Only)

1. Access the WhatPulse Web Dashboard: Log in to your WhatPulse account on the WhatPulse homepage.
2. Navigate to Settings: Once logged in, locate the settings or account management section.
3. Generate API Key: Look for an option related to 'API' or 'API Keys'. You should find a button or link to generate a new API key. WhatPulse provides specific instructions on API key generation within its WhatPulse help documentation.
4. Securely Store Your Key: Once generated, the API key will be displayed. It is crucial to copy this key immediately and store it securely. WhatPulse typically shows the key only once upon generation for security reasons. If lost, you will likely need to generate a new one.

For Username and Password

1. Account Registration: If you don't have an account, register one via the WhatPulse desktop client or the WhatPulse website. You will choose a username and set a password during this process.
2. Login: Use your registered username and password to log into the WhatPulse desktop client or the web dashboard.

Authenticated request example

When making an authenticated request to the WhatPulse API, you typically include your API key as a query parameter or an HTTP header. The WhatPulse API documentation specifies the exact method, but commonly it is passed as a query parameter named api_key.

Here's an example of an authenticated request using curl to retrieve user statistics, assuming the API key is passed as a query parameter:

curl "https://api.whatpulse.org/v1/user/<YOUR_USERNAME>?api_key=<YOUR_API_KEY>"

In this example:

• <YOUR_USERNAME> should be replaced with your actual WhatPulse username.
• <YOUR_API_KEY> should be replaced with the API key you generated from your WhatPulse dashboard.

Always refer to the official WhatPulse API documentation for the most accurate and up-to-date request syntax and available endpoints. The structure of API calls, including how parameters are passed and how responses are formatted, can vary between different API versions and specific endpoints.

Security best practices

Implementing robust security practices when dealing with authentication credentials is essential to protect user data and maintain system integrity. For WhatPulse authentication, consider these best practices:

• API Key Management:
  • Environment Variables: Store API keys in environment variables rather than hardcoding them directly into your application's source code. This prevents keys from being exposed in version control systems.
  • Secure Storage: If storing keys in configuration files, ensure these files are not publicly accessible and are encrypted where possible.
  • Rotation: Periodically rotate your API keys by generating new ones and revoking old ones. This minimizes the risk if a key is compromised.
  • Least Privilege: Only grant the necessary permissions to API keys, if the WhatPulse API supports granular permissions.
  • Avoid Client-Side Exposure: Never expose API keys directly in client-side code (e.g., JavaScript in a web browser) where they can be easily extracted by malicious actors. All API calls requiring authentication should originate from a secure server-side environment.
• Strong Passwords: For username/password authentication, use unique, complex passwords that combine uppercase and lowercase letters, numbers, and symbols. Avoid common words or easily guessable sequences. Tools like password managers can assist in generating and storing strong passwords.
• HTTPS/TLS Usage: Always ensure that all communication with WhatPulse, whether through the desktop client, web dashboard, or API, occurs over HTTPS (Hypertext Transfer Protocol Secure). HTTPS encrypts data in transit, protecting credentials and data from interception by third parties. The IETF's RFC 2818 defines HTTP over TLS, which is the underlying technology for secure web communication.
• Input Validation: Implement rigorous input validation on all data submitted by users, including credentials. This helps prevent common web vulnerabilities such as SQL injection or cross-site scripting (XSS) that could compromise authentication mechanisms.
• Error Handling: Design error messages carefully. Avoid revealing too much information about the authentication process or system internals that could aid an attacker. Generic error messages (e.g., "Invalid credentials") are generally preferred over specific ones (e.g., "Username not found").
• Regular Audits: Periodically review access logs and audit trails, if available, for suspicious activity related to authentication attempts or API key usage.