Authentication

Create keys in Settings > Developer API in your Bizflow account. Only account administrators can issue and revoke keys. Each key is bound to one tenant and one environment. Keys from this API cannot access account-management routes.

Authorization: Bearer YOUR_BIZFLOW_API_KEY

Do not send tenant headers. Unknown request fields are rejected. Each key has an expiry and is displayed only once; Bizflow stores a hash, not the usable secret.

Scope	Access
products:read	Product status and reference codes
products:write	Product registration
stock:write	Absolute stock balance commands and their status
invoices:read	Fiscal invoices, credits, document list and PDFs
invoices:write	Fiscal invoices
credits:write	Credit notes against accepted API invoices

Choose only the scopes your integration needs. Keys expire within one year. To rotate a key, create a replacement, update your server secret, confirm it works and revoke the old key. Never log Authorization headers.

Rate limits

The API permits 120 requests per minute per key, including status checks. On 429, obey Retry-After. Expired or revoked keys return 401; insufficient scope returns 403. Keys from suspended or unavailable accounts are not accepted.

Interactive reference

The reference does not persist your key. Use sandbox credentials only in the interactive reference, and clear them afterwards. Requests go directly to Bizflow; your browser origin must be approved for API access. Server-to-server callers do not require CORS access.