Permissions and API Keys

Permissions control specific actions on each resource. They are named action:resource, in lowercase:

• The four basic actions for each resource: create, read, update and delete (for example, read:invoices to view invoices).
• Special actions, such as stats:dashboard (view the dashboard), resend:invoices (resend invoices), cancel:subscriptions (cancel subscriptions), upload-payment-proof:invoices (upload payment proofs) or manage:onboarding (configure the online sign-up).

In the Permissions menu you see the full catalog. It is read-only: permissions are not assigned one by one to people; instead, they are grouped into roles. To see what a specific person can do, open their user and review their effective permissions.

API Keys

To connect other systems to Inspow, create an API Key in the Api Keys menu → Create Api Key:

• Name and Description.
• Scopes: what the key can do (read_only, write_only, read_write, admin or device for access devices).
• Status, Allowed Origins and Allowed IPs (to restrict where it is used from).
• Expires At and the Rate Limit (requests per hour).

When you create it, the full key is shown only once: copy it and store it in a safe place. Afterwards, the list shows its identifier, status, scopes, expiration, last use and number of uses. See the API documentation to use it.

Caution

API Keys are sensitive credentials. Revoke them if you suspect they have been leaked.