Definition
An API key is a long secret string that a program sends with each API request to prove which account or business it acts for and what it may do. In accounting software it replaces a username and password for integrations such as e-commerce stores, payroll systems or scripts that post journal entries automatically.
How it works
The key travels in a request header, usually as a Bearer token: Authorization: Bearer <key>. The server looks it up, checks that it is active and has the required ability, and runs the request in the context of the business the key belongs to.
In Ledgeriano every key belongs to one business and is managed by the owner: it has read or write abilities, can be rotated when someone leaves or a key may have leaked, and can be revoked instantly. Each call is recorded in the audit trail with the key that made it, so you can see which integration posted which entry.
Treat a key like a password. Store it in a secret manager or environment variable, never in front-end code or a public repository, give each integration its own key with the smallest abilities it needs, and rotate keys on a schedule. The accounting API guide shows a complete integration.
Example: posting an entry with an API key
An online store creates a sales entry after each paid order. Its server calls POST /api/v1/journal-entries with Authorization: Bearer <store key> and an Idempotency-Key: shop-order-1045 header. If the key is revoked, the call fails with 401 and no entry is created.