Partner-Scoped Token
Backend onlyManage multiple businesses:
- List all businesses
- Create new businesses
- Get business-scoped tokens
Business-Scoped Token
Frontend safeAccess single business:
- Invoices and payments
- Reports and GL
- Isolated to one business
Get Partner-Scoped Token
Exchange your credentials for a partner-scoped token:Get Business-Scoped Token
Exchange partner-scoped token for business-scoped token:Token Usage
- Partner-Scoped Token
- Business-Scoped Token
Use for managing businesses:
GET /v1/platform/businesses/- List all businessesPOST /v1/platform/businesses/- Create businessPOST /v1/platform/{business_id}/oauth2/token/- Get business-scoped token
Token Lifecycle
1
Tokens expire after 1 hour
Both token types expire after 3600 seconds.
2
Handle expiration
When you receive
401 Unauthorized:- Re-authenticate to get fresh token
- Retry the failed request
3
Best practice
Cache tokens and refresh before expiry to avoid disruptions.
Security Best Practices
Never expose credentials
Never expose credentials
Store partner UUID and API key securely:
- Environment variables
- Secrets manager (AWS Secrets Manager, HashiCorp Vault)
- Never commit to source control
Use HTTPS only
Use HTTPS only
All API calls must use HTTPS. HTTP requests will be rejected.
Rotate API keys periodically
Rotate API keys periodically
Regenerate keys every 90 days via Partner Portal for security hygiene.
Tokens secured. Now embed the accounting UI in your platform.