Authentication

Create an API key, send it correctly, and understand what a key can and cannot do.

Every request needs an API key. Keys are created from your signed-in Taxlyne account and then sent with each request.

Send the key in `X-API-Key`

curl https://api.taxlyne.com/api/v1/invoices \
  -H "X-API-Key: sk_live_a1b2c3d4e5f67890abcdef1234567890"

X-API-Key is the only header that works. You may see Authorization: ApiKey … or an ?apiKey= query parameter referenced elsewhere. Neither is supported — both return 401. Use the header above.

Creating a key

Keys are created from a signed-in session. You cannot create an API key using an API key — that is deliberate, so that a leaked key cannot mint itself a broader one.

Create the key

curl -X POST https://api.taxlyne.com/api/v1/api-key \
  -H "Authorization: Bearer <your session token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production integration",
    "type": "LIVE",
    "keyableType": "BUSINESS",
    "businessId": "clxyz123abc456def789",
    "scopes": ["invoices:read", "invoices:write", "firs:read"]
  }'

keyableType decides what the key acts as:

`keyableType`	Requires	The key acts for
`USER`	—	Your user, across every business you own
`BUSINESS`	`businessId`	That one business

Use USER for now. A BUSINESS-scoped key currently fails on POST /invoices with 404 Business not found — the key identifies itself as the business, and the ownership check then looks for a business owned by itself. We are fixing it; until then a USER key is the working path, and it reaches every business you own.

Store it immediately

The full key is returned in the key field of the response. Store it in your secret manager.

If you lose it you can retrieve it again with GET /api-key/:id/reveal from a signed-in session — unlike most APIs, the secret is recoverable rather than write-once. That is a convenience and also a reason to treat portal access as sensitive as the key itself.

Two behaviours that will surprise you

Creating a key revokes your existing key of the same type. If you already have a LIVE BUSINESS key and create another, the first is revoked immediately and any integration using it starts returning 401. Rotate deliberately: create the new key, deploy it, and expect the old one to have already stopped working.

Omitting scopes grants full access. A key created without a scopes list holds the * wildcard — every permission. If you want a restricted key, you must say so at creation. See Scopes and permissions.

Managing keys


`GET /api-key`	List your keys (never includes the secret)
`GET /api-key/:id`	One key's details
`GET /api-key/:id/reveal`	Show the full key again
`DELETE /api-key/:id`	Revoke a key, immediately and permanently

All four require a signed-in session, not a key.

There is no rotate endpoint. To rotate, create a replacement — which revokes the old one as described above.

If a key leaks

Revoke it with DELETE /api-key/:id. Revocation takes effect immediately. Then create a replacement and deploy it.

Authentication

On this page