Guides

API Keys

Generate and manage API Keys for server-to-server integrations.

API Keys let external systems connect to your Organization in Inspow through server-to-server integrations, without signing in as a User. Each key belongs to one Organization and only accesses its data.

Generate an API Key

When you create a key, you set a name (3 to 100 characters), an optional description and its permissions (scopes). Optionally, you can set an expiration date, a limit of requests per hour (between 1 and 10,000, 1,000 by default), a list of allowed origins (domains) and a list of allowed IPs.

Permissions (scopes)

Scope	Access
`read_only`	Read only (default value)
`write_only`	Write only
`read_write`	Read and write
`admin`	Full access; covers any other required permission
`device`	Exclusive to attendance devices (kiosks/readers): it only works on the device endpoints and gives no access to the rest of the API

Key statuses

Status	Meaning
`active`	Active and operational
`inactive`	Inactive
`revoked`	Manually revoked
`expired`	Expired by its expiration date

Only keys with the active status can authenticate requests.

Manage and revoke

You can list your keys (with filters and search), look up one by its identifier, update its details, revoke a key (it moves to the revoked status and stops working) and delete it permanently. Each key keeps its usage counter, its last usage date and a recent history of requests.

Server-to-server usage

Send the key in every request with the X-API-Key header, or in Authorization with the Bearer or ApiKey prefix. Requests with an invalid, revoked or expired key are rejected; if you exceed the hourly limit, the request is rejected with 403 (“Rate limit excedido”) until the hour is up; the same happens if it comes from an IP or a domain that is not on the allowed lists.

curl https://api.inspow.tech/api/v1/restaurant/plans \
  -H "X-API-Key: ak_xxxxxxxx.xxxxxxxxxxxxxxxx"

What data it reaches

An API Key accesses the data of its Organization (Plans, Subscriptions, Invoices, Beneficiaries, Attendance Records, etc.), within the reach of its scopes. In the endpoints, the people served are always beneficiaries, whatever the sector (Members, Students, Club members, Coworkers or Patients in the app).