Every business has one API key, shaped like bk_ followed by 48 hex characters.
Sending the key#
Any of these works on create-document, calculate, documents and customers:
X-Api-Key: bk_0123…Authorization: Bearer bk_0123…The Invoice4U-compatible shape ({"doc": {…}, "token": "<key>"}) sends the key as token in the JSON body, exactly like Invoice4U's CreateDocument. When doc is present the key is read from token only — a header is ignored for that request.
If both X-Api-Key and Authorization are sent, X-Api-Key wins.
Getting a key#
- Sandbox: the key is returned once by
POST /api/developers/sandbox— see sandbox. - A real business: open the API section ("API לאתרים") of the dashboard settings page,
/billing/settings. The key is shown in full once, at the moment it is minted or rotated; afterwards only a masked hint (bk_••••abcd) is shown.
Only a SHA-256 hash of the key is stored, so SLK cannot show it to you again. If you lose it, rotate it: the old key stops working immediately and a new plaintext key is shown once.
Rotating and revoking#
Rotate from the same settings section (owner/admin). Closing a business revokes its key at once, and a closed business's key authenticates nothing even if it survived somewhere.
What the key can do#
The key is a full-access credential for that one business: issue documents (subject to plan and dormancy), read documents and customers, create customers, run calculations, and drive the MCP endpoint. Treat it like a password: server-side only, never in browser code, never in a public repo.
Failures#
| Situation | Response |
|---|---|
| Missing, unknown, revoked or over-long key | 401 {"error":"invalid API key"} (compat shape: 401 {"d":{"IsSuccess":false,"ErrorMessage":"auth failed"}}) |
| More than 600 requests/minute for the key | 429 {"error":"rate limited"} — checked before authentication, keyed by the key's hash |
Multi-tenant resolution#
A server-to-server call carries no session, so the key itself is the tenant selector: a control-plane registry maps each key hash to its business and the request then runs inside that business's database. There is no way to address another business.
Webhook secrets are different#
Outbound webhooks are signed with a per-endpoint signing secret, not the API key. See webhooks.