Auth Information for V3 API Partners

Partner Authentication

All requests to this API require Partner-level authentication.

x-api-key
Partner API Key (used to identify the Partner).

x-company-id
The ID of the company being operated on.
Must belong to a company associated with the authenticated Partner.

x-timestamp
Request timestamp in Unix epoch milliseconds.
Prevents replay attacks. Requests older than 5 minutes will be rejected.

x-signature
HMAC-SHA256 signature of the request, signed with the Partner’s secret and Base64-encoded.

Concatenate the following values, separated by |:

{timestamp}|{HTTP_METHOD}|{PATH}|{BODY}

timestamp: The value from x-timestamp.

HTTP_METHOD: Uppercase HTTP method (e.g., GET, POST).

PATH: Request path including params and query params (e.g., /v1/invoices).

BODY: JSON-encoded request body (or empty string).

Example string to sign:

1726744512000|POST|/v1/invoices/1?status=paid{"amount":100,"currency":"USD"}

Example Node.js code:

The resulting signature must match the value sent in x-signature.