Authentication

Send your key as a bearer token on every call.

curl "$PANOQORE_URL/v1/me" -H "Authorization: Bearer $PANOQORE_API_KEY"

{
  "id": "key_01M6F1ABHKF2BTA49QYK5MQPSF",
  "scopes": ["read", "entries:write", "holds:write", "named:write"],
  "tenantId": "tnt_01M6F1ABHKF2K8GS124ZZBR194",
  "tenantSlug": "acme",
  "environment": "sandbox"
}

A missing, wrong, revoked or expired key gets 401 UNAUTHENTICATED, and the answer does not say which. So does a key used from a network it is not allowed on.

Getting a key

A tenant admin creates keys in the console. The secret is shown once and only a hash is stored. A key looks like pk_<live|test>_<id>_<secret>. A live key with any write scope needs approval before it works, and whoever asked for it collects the secret afterwards. Managing keys is console work: it needs the manage scope, which no key can hold.

Scopes

Scope	Allows
`read`	Reading.
`entries:write`	Accounts, entries, reversals, lending events, FX conversions. Also reads most of what it writes.
`holds:write`	Holds: create, capture, release, read.
`named:write`	Binding named accounts and recording inbound credits.
`fx:write`	Getting FX quotes. A conversion needs `entries:write`.
`recon:write`	Sending statements and running a match.
`webhooks:manage`	Webhook endpoints.

Each page in the API reference names the scopes it accepts. Calling without one gets 403 MISSING_SCOPE, and error.details.scope names what is needed. payments:write can be set on a key, but nothing uses it yet.

What a key cannot do

Keys post directly. They never propose or approve. These always need a person: approving or rejecting a request, freezing an account, changing an overdraft limit, closing a period, setting fee schedules and FX rates, and switching account modules on. The one exception is a loan write-off: a key can ask for one, and a person must approve it. See Lending.

Rotation and revocation

Rotating a key gives you a new secret and the old one keeps working for an overlap, so you can deploy without a gap. A revoked key can keep working for up to 60 seconds, because verified keys are cached that long.

Keep keys on your server

Keys are not for browsers or mobile apps. Browser calls are allowed only from configured origins, which is the console.

Get started

Using the API

Concepts

Guides

Getting a key

Scopes

What a key cannot do

Rotation and revocation

Keep keys on your server

​Getting a key

​Scopes

​What a key cannot do

​Rotation and revocation

​Keep keys on your server

Getting a key

Scopes

What a key cannot do

Rotation and revocation

Keep keys on your server