Skip to main content
The Bousol API uses API keys to authenticate requests. This guide covers creating, managing, and using API keys.

​
API Key Types

TypePrefixUse
Livesk_live_Production environment
Testsk_test_Sandbox/testing environment
Important: Keep your API keys secure. Never expose them in client-side code or public repositories.

​
Creating API Keys

​
Via Dashboard

  1. Log in to the Enterprise Dashboard
  2. Go to Developers → API Keys
  3. Click Create API Key
  4. Configure the key:
FieldDescription
NameDescriptive name (e.g., “Production Server”, “POS Integration”)
EnvironmentLive or Test
ScopesWhich API endpoints the key can access
ExpirationOptional expiration date
  1. Click Create
  2. Copy the key immediately — it won’t be shown again

​
Key Display

After creation, you’ll see: 
sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
This is the only time the full key is displayed. Store it securely.

​
Using API Keys

​
Authorization Header

Include the API key in the Authorization header: 
GET /mfi/invoices HTTP/1.1
Host: api.bousol.app
Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

​
cURL Example

curl https://api.bousol.app/mfi/invoices \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

​
JavaScript Example

const response = await fetch('https://api.bousol.app/mfi/invoices', {
  headers: {
    'Authorization': 'Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
    'Content-Type': 'application/json'
  }
});

​
Python Example

import requests

headers = {
    'Authorization': 'Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.bousol.app/mfi/invoices', headers=headers)

​
Scopes

API keys can be restricted to specific scopes:
ScopeDescription
invoices:readView invoices
invoices:writeCreate and update invoices
payment-links:readView payment links
payment-links:writeCreate payment links
clients:readView clients
clients:writeCreate and update clients
payouts:readView payouts
payouts:writeCreate payouts
disbursements:readView disbursements
disbursements:writeCreate disbursements
webhooks:readView webhook endpoints
webhooks:writeManage webhook endpoints

​
Full Access

To create a key with full access, select all scopes or use the “Full Access” option.

​
Minimal Scopes

For security, use the minimum scopes necessary. For example, a reporting integration might only need:
  • invoices:read
  • payouts:read
  • clients:read

​
Managing API Keys

​
Viewing Keys

Go to Developers → API Keys to see all keys:
ColumnDescription
NameKey name
EnvironmentLive or Test
CreatedCreation date
Last UsedMost recent API call
ScopesPermitted operations
StatusActive or Revoked

​
Revoking Keys

To revoke a key:
  1. Go to Developers → API Keys
  2. Find the key to revoke
  3. Click Revoke
  4. Confirm the action
Revoked keys immediately stop working. Any requests using the key will receive a 401 Unauthorized response.

​
Rotating Keys

To rotate a key (create new, revoke old):
  1. Create a new API key with the same scopes
  2. Update your application to use the new key
  3. Verify the new key works
  4. Revoke the old key

​
Key Expiration

Set expiration dates for enhanced security:
  • Keys expire automatically at midnight UTC on the expiration date
  • Expired keys return 401 Unauthorized
  • Set reminders to rotate keys before expiration

​
Security Best Practices

​
Do

  • Store keys in environment variables
  • Use separate keys for different environments (dev, staging, production)
  • Use minimal scopes for each integration
  • Rotate keys periodically
  • Revoke unused keys
  • Monitor key usage in the dashboard

​
Don’t

  • Commit keys to version control
  • Share keys via email or chat
  • Use live keys in development
  • Use a single key for multiple applications
  • Ignore key security warnings

​
Environment Variables

Store keys in environment variables: 
# .env file (never commit this)
BOUSOL_API_KEY=sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

// Use in code
const apiKey = process.env.BOUSOL_API_KEY;

​
Troubleshooting

​
401 Unauthorized

CauseSolution
Missing headerAdd Authorization: Bearer <key>
Invalid keyCheck for typos, verify key is correct
Revoked keyCreate a new key
Expired keyCreate a new key
Wrong environmentUse sk_live_ for production, sk_test_ for sandbox

​
403 Forbidden

CauseSolution
Insufficient scopesCreate a new key with required scopes
Resource not accessibleVerify you have access to the resource

​
API Key Webhooks

Get notified about key events:
EventDescription
api_key.createdNew key created
api_key.revokedKey was revoked
api_key.expiringKey expires in 7 days
api_key.expiredKey has expired
See Webhooks to configure notifications.

​
Next Steps