SHAPI authentication

Direct calls to https://sive.host/modules/addons/shapi/sh-api.php require all three layers below:

1. Source IP allowlist: add the integration egress IP on the authenticated SHAPI client page.
2. HTTP Basic authentication: use the username/password displayed on that page.
3. Customer key: send api_key and api_secret in the POST body.

export SHAPI_HTTP_USER='value-from-client-area'
export SHAPI_HTTP_PASSWORD='value-from-client-area'
export SHAPI_API_KEY='your-customer-api-key'
export SHAPI_API_SECRET='your-customer-api-secret'

curl --request POST 'https://sive.host/modules/addons/shapi/sh-api.php' \
  --user "${SHAPI_HTTP_USER}:${SHAPI_HTTP_PASSWORD}" \
  --data-urlencode "api_key=${SHAPI_API_KEY}" \
  --data-urlencode "api_secret=${SHAPI_API_SECRET}" \
  --data-urlencode "action=AccountSummary"

ChatGPT OAuth

The Sive.Host ChatGPT plugin uses OAuth authorization-code flow with PKCE at https://sh.sive.ai/mcp or https://ai.paas.africa/mcp. Both use the Sive.Host authorization server. Enter the customer API key and secret only on the Sive.Host authorization page. The MCP service supplies its own allowlisted source IP and HTTP Basic layer.

Credential hygiene

• Never publish live sample keys or secrets.
• Disable or delete a key immediately if it is exposed.
• Use POST bodies, not query strings.
• Keep TLS verification enabled.

SHAPI documentation version 2.0.