Check access
Open Account security and review the developer-access status. Normal app access and MFA do not require a higher tier. Account trials and staff status do not substitute for the required subscription.
Choose the scope
Name the integration, select the smallest required read/write scopes and choose an expiry of 1–365 days. Read scopes can reveal private metadata and playback capabilities; write scopes can change or delete resources.
Copy once and store privately
Verify your password and second factor when required, create the token and copy it once. Store it in your server secret manager or private environment. Never put it in frontend code, a URL, source control or a public MCP configuration.
Test and plan revocation
Follow the API guide for a first read request. Revoke the token from Account security when the integration ends. Expiry, security-session changes and loss of the required subscription stop access. Keep token inventory and revocation available after a downgrade.
What success looks like
Your integration can make an authorised scoped request, while other resources and permissions remain denied.
If it does not work
401 usually means missing/expired/revoked credentials; 403 can mean scope, plan or another policy. Do not solve a denied request by granting every scope. See the exact method/path reference.
Contact CamBackup support with safe error text, time/timezone and the steps tried. Never send passwords, tokens, OTPs, recovery codes or credential-bearing camera addresses.