e-Hansae-Hansa
← Documentation

API keys

Let your own software read and write one company's data.

An API key lets a program talk to e-Hansa the way you do in the browser - fetch invoices, create a partner, record a payment - without a person signing in. If you have a webshop, a till, or a script that prepares invoices, this is how it reaches your books.

One key, one company

A key belongs to the company it was created in and works nowhere else. If you run several companies, each needs its own key. That is deliberate: it means revoking a key stops exactly one integration, and a key that leaks cannot reach anything you did not point it at.

Creating one

  1. Open Settings → API keys.
  2. Give it a name you will recognise later - “Webshop sync”, not “key 2”.
  3. Choose Read only, or Read & write if the software needs to create or change things.
  4. Optionally set an expiry date.
  5. Create it, and copy the key straight away.

The key is shown once and never again. We store only a fingerprint of it, so if it is lost you create a new one and revoke the old - there is no way for anyone, including us, to read it back.

Who can do what

Only the company owner can create or revoke keys. Everyone else in the company can see the list - the names, when each key was made and when it was last used - but there is no secret in that list to leak. Seeing which integrations have access is exactly what you need before switching one off.

Using it

Send the key as a bearer token in the Authorization header, the same place a browser session token goes. The API reference at /api-docs lists every endpoint, what it accepts and what it returns.

When a key stops working

  • You revoke it - it stops immediately, and stays on the list so you can still see what once had access.
  • It reaches its expiry date.
  • The person who created it loses access to the company, or is blocked. An integration set up by someone who has since left does not keep reading your books.
  • A read-only key is used to change something - it is refused rather than partially applied.

Choosing the permission

Prefer Read only. Reporting, dashboards, exports and anything that only looks at your data should never need more, and a read-only key that leaks cannot alter a figure or confirm a document. Use Read & write only for software that genuinely has to create invoices, partners or payments.

Last used tells you whether a key is still doing anything. If it is blank or months old, it is safe to revoke - and safer than leaving it.