API keys and the API

An API key is a password that belongs to a program instead of a person. Treat it the same way: issue one per system, and replace it when that system changes.

Create a key

1. Open API → API management and press New key.
2. Give it a name that says which system uses it.
3. Choose its Permissions: Full access, or only the areas the system needs. Most areas distinguish reading, creating and changing.
4. Choose an expiry date, or none.
5. Use Show and Copy on the key card to hand the key to the calling system. The system sends it in the authtoken header.

Each key card shows the permissions, the creation date, Last used and a badge such as “active” or “expires in 5 days”.

Renew a key before it expires

Fourteen days before a key expires, you get one notification in the bell. Press Renew on the key card and choose the new expiry date. IDup creates a new key with the same permissions. Copy it at once, because this display appears only once. The old key stays valid until its own expiry, so you can switch the system over without a gap.

The areas you can reach

The API covers your customer data and, depending on your plan, properties and rentals, search profiles, tax files, trustee files, accounting, payroll runs and receipt scanning. AI Studio and the inbox have their own areas. The API guide lists only the areas your plan includes.

The API guide

Open the Documentation tab on the API management page, or API → API guide. Each area shows its fields, request examples you can copy, example answers and error codes.

Webhooks and other interfaces

• The Webhooks tab sends events to your system as they happen — see Send events to your own system with webhooks.
• If the Customer API is switched on, a Customers API Settings tab opens its settings, for example whether customers may register through the API.
• Automation / workflows → Technical interface issues a token for the GraphQL interface.
• AI Studio → Personal API keys is a separate set of keys.

Keeping it safe

1. One key per system, never a shared one.
2. Give a key only the permissions the system needs.
3. Set an expiry date and renew on a schedule.
4. Delete a key as soon as somebody who knew it leaves, or the system is switched off.