Authentication
All API requests require a valid API key in the Authorization header.
Getting your API key
- Go to Settings > API in the Finseo dashboard
- Click Create API Key
- Choose a name, scopes, and optionally restrict to specific projects
- Copy the key immediately - it will only be shown once
Using your key
Verifying a key
GET /v1/me returns the account behind a key. Use it to check that a key is valid, to show
users which account they connected, and to read the key’s scopes — it answers independently of
whether the account has any projects yet, which makes it the right endpoint for integrations
and connection tests.
An invalid or revoked key returns 401 with error code UNAUTHORIZED.
Scopes
API keys can have one or more scopes:
Project restrictions
Optionally restrict a key to specific projects. A key with no project restrictions can access all projects owned by your account.
Key security
Never expose API keys in client-side code or public repositories.
- Keys are hashed with SHA-256 before storage - we never store plaintext
- Rotate keys regularly and revoke compromised keys immediately
- Use test keys for development, live keys for production