---
title: "API key"
description: "What an API key is, how accounting APIs use Bearer keys, how scopes, rotation and revocation work in Ledgeriano, and the security rules for storing keys safely."
canonical: https://ledgeriano.com/glossary/api-key
language: en
publisher: "Ledgeriano"
updated: 2026-11-06
---

# API key

> What an API key is, how accounting APIs use Bearer keys, how scopes, rotation and revocation work in Ledgeriano, and the security rules for storing keys safely.

An API key is a long secret string that a program sends with each API request to prove which account or business it acts for and what it may do. In accounting software it replaces a username and password for integrations such as e-commerce stores, payroll systems or scripts that post journal entries automatically.

The key travels in a request header, usually as a Bearer token: `Authorization: Bearer <key>`. The server looks it up, checks that it is active and has the required ability, and runs the request in the context of the business the key belongs to.

In [Ledgeriano](https://ledgeriano.com/developers) every key belongs to one business and is managed by the owner: it has read or write abilities, can be rotated when someone leaves or a key may have leaked, and can be revoked instantly. Each call is recorded in the audit trail with the key that made it, so you can see which integration posted which entry.

Treat a key like a password. Store it in a secret manager or environment variable, never in front-end code or a public repository, give each integration its own key with the smallest abilities it needs, and rotate keys on a schedule. The [accounting API guide](https://ledgeriano.com/guides/accounting-api) shows a complete integration.

## Example: posting an entry with an API key

An online store creates a sales entry after each paid order. Its server calls `POST /api/v1/journal-entries` with `Authorization: Bearer <store key>` and an `Idempotency-Key: shop-order-1045` header. If the key is revoked, the call fails with 401 and no entry is created.

### What is the difference between an API key and an OAuth token?

An API key is a static secret issued to one integration and valid until revoked. An OAuth token is issued after a user grants access and usually expires quickly. Keys suit server-to-server integrations you control.

### What should I do if an API key leaks?

Revoke or rotate it immediately, update the integration with the new key, and review the audit trail for calls made with the old key.

Guide: https://ledgeriano.com/guides/accounting-api