Authentication

How the planned CoreLink API authenticates requests, with one API key per company whose environment comes from the company.

Every request carries an API key in the Authorization header:

Authorization: Bearer clk_test_…

One key, one company

A key belongs to one company. There is no header to choose a company: the API only sees the data of the key’s company, and never reveals whether a resource exists in another one.

Environments

The environment isn’t chosen per request. It comes from the company that owns the key:

Prefix	Company	Environment
clk_test_	A sandbox company	test: documents go to the tax authority’s test set
clk_live_	A production company	live: documents have fiscal effect

Test and live data never mix: a test key can’t read or issue anything in the production company, and the other way round. GET /v1/me tells you the environment of a key.

Scopes

Each key is granted scopes, and each operation requires one. A key never has more permissions than the person who created it. A valid key without the required scope gets 403 insufficient_scope; GET /v1/me works with any valid key.

Scope	Grants	Operations
parties:read	Read third parties (customers, suppliers and other parties).	GET /v1/parties GET /v1/parties/{id}
products:read	Read the product and service catalog.	GET /v1/products GET /v1/products/{id}
invoices:read	Read sales invoices, credit and debit notes, their tax authority status and their PDF/XML.	GET /v1/invoices GET /v1/invoices/{id} GET /v1/invoices/{id}/pdf GET /v1/invoices/{id}/xml
invoices:write	Transmit existing invoices to the tax authority.	POST /v1/invoices/{id}/issue
received:read	Read electronic documents received from suppliers.	GET /v1/received-documents
receivables:read	Read accounts receivable (open customer balances).	GET /v1/receivables GET /v1/receivables/{id}
payments:read	Read the accounts payable payment schedule.	GET /v1/scheduled-payments GET /v1/scheduled-payments/{id}
organization:read	Read the organization, the company profile and its operating units.	GET /v1/organization GET /v1/company GET /v1/units GET /v1/units/{id}

Invalid keys

A missing, unknown or revoked key gets 401 unauthorized. See Errors.