Skip to main content
POST
string
required
Bearer token: Bearer YOUR_ACCESS_TOKEN
string
required
A human-readable label for this key (e.g. "Production Backend", "Staging Integration").
array
List of permission scopes. Omit to grant all scopes. Available values: transactions:read, transactions:write, accounts:read, accounts:write, webhooks:manage, analytics:read
string
Optional expiry timestamp (ISO 8601). The key will be automatically revoked after this time.
The api_secret is returned only once at creation. Store it securely — it cannot be retrieved again. If lost, revoke the key and create a new one.
Using your API key: After generating a key, call POST /auth/token with your api_key and api_secret to generate a Bearer token. Bearer tokens expire in 60 minutes — refresh as needed. API keys themselves never expire unless you set expires_at at creation time.