Skip to main content
API keys authenticate requests to the Invopop API. Every key belongs to a single workspace and carries its own set of permissions, so an integration only gets access to the services it actually needs. Keys are managed in Admin. The Console shows the keys of the current workspace under Configuration → API keys, and the Manage API keys button on that page takes you to the API keys section of Admin, where keys are created, reviewed and revoked.

​
Create an API key

  1. Open Admin and select API keys in the sidebar, or click Manage API keys from the Console.
  2. Click New API key.
  3. Choose the workspace the key will act on. A key never has access to more than one workspace, so sandbox and live environments always use different keys.
  4. Give the key a name for future reference and, optionally, a description of its use case.
  5. Tick the permissions the key needs for each service (see Permissions below).
  6. Click Create API key.
New API key form in Admin showing the workspace, name, description and per-service Read and Admin checkboxes
The token is displayed once, immediately after creation. For security reasons Invopop does not store it, so copy it to a safe place now. If it is lost, revoke the key and create a new one.
Invopop uses JSON Web Tokens. If you’re interested in seeing the contents, head over to JWT.io and paste your token to see what’s inside.

​
Permissions

Permissions are granted per service and per resource. Each resource has two checkboxes:
  • Read allows the key to list and fetch the resource.
  • Admin allows the key to create, update and delete the resource as well as read it.
Give each key only what it needs. A key that only submits invoices needs Admin on Silo entries and Transform jobs, and nothing else. A reporting or monitoring integration usually needs Read only. Use All services only for keys that genuinely need to do everything, such as a full back-office integration. The Admin list groups every key by workspace, with separate sections for live and sandbox workspaces, and shows the permission level of each key: admin, read, or No permissions for a key with nothing ticked. Review this list periodically and revoke keys that are no longer in use.

​
Use the token

Tokens must be included in the Authorization HTTP header in all requests as a type Bearer. Test everything is working correctly using the ping endpoint and curl:
A successful ping confirms the token is valid. If a request to another endpoint is rejected with a permission error, check the key’s permissions in Admin.