Skip to main content
Every request to the Integration API is authenticated with an API key sent in the X-Api-Key header. There are no other credentials to manage — no OAuth flow, no tokens to refresh.

​
Create an API key

API keys are created inside the platform, not over the API.
1

Open API Keys

In the app, go to Settings → Integrations → API Keys (/settings/integration/api-keys). See API Keys for the full settings reference.
2

Name and scope the key

Give the key a descriptive name and select only the scopes the integration needs (for example invoices:write).
3

Copy the secret

Select Create API Key. The secret — which looks like fat_… — is shown only once. Copy it immediately and store it securely; you won’t be able to see it again.

​
Send the key

Add the key to the X-Api-Key header on every request:
A missing or invalid key returns 401 Unauthorized; a valid key that lacks the scope an endpoint requires returns 403 Forbidden — see Errors.

​
Key scope and security

  • One company per key. Each key is scoped to a single company/tenant. To integrate with several companies, create one key per company.
  • Least privilege. Grant only the scopes the integration uses.
  • Treat it like a password. Store keys in a secret manager, never in source control or client-side code.
If a key is lost or compromised, revoke it under Settings → Integrations → API Keys and create a new one. Revocation takes effect immediately.

​
Next