Authentication
How API keys, scopes and environments work.
Last updated 2026-07-22
The ExaLedger API authenticates every request with a bearer API key. There are no cookies or sessions — a key is all you need.
Authorization: Bearer exl_live_xxxxxxxxxxxx
Creating a key
Go to Settings → API keys and choose Create key. You'll pick:
- a name (so you can recognise it later),
- the scopes the key may use, and
- optionally an expiry.
The raw secret is displayed once, at creation. We only ever store a hash of it, so if you lose it you must create a new one.
Scopes
A key can only do what its scopes allow — and a key can never exceed the permissions of the person who created it. Scopes mirror your role permissions:
| Scope | Grants |
|---|---|
company.view | Read company data (contacts, items, invoices) |
journal.post | Create invoices, contacts and other postings |
Request the fewest scopes your integration needs. A read-only integration
should hold only company.view.
Environments
Keys are tagged live or test (the prefix exl_live_ / exl_test_) so you can
tell them apart in logs and dashboards.
Revoking a key
Revoke a key any time from Settings → API keys. Revocation is immediate — the
next request with that key is rejected with a 401.
Keeping keys safe
- Never embed a key in client-side code or a public repository.
- Store keys in a secrets manager or environment variable.
- Rotate keys periodically, and immediately if one may have leaked.