Developers
Authentication
Create an API token, send it with every request, and scope it to exactly the access an integration needs.
The Quelixa API authenticates with bearer tokens. A token is tied to your workspace and carries a set of scopes that bound what it can do.
Create a token#
- Open API settings
In your workspace go to Settings → Developer → API Tokens.
- Create and scope it
Name the token for its purpose ("Zapier sync"), choose its scopes, and set an optional expiry.
- Copy it once
The token is shown only at creation. Copy it into your secret store now — you can't retrieve it again, only revoke and recreate.
Make an authenticated request#
Send the token as a bearer credential in the Authorization header:
curl https://acme.quelixa.com/api/v1/customers \
-H "Authorization: Bearer qx_live_8f2c…" \
-H "Accept: application/json"A successful call returns 200 with a JSON body. A missing or invalid token returns 401; a valid token without the required scope returns 403.
Scopes#
Tokens are least-privilege by design. Grant only what the integration needs.
| Scope | Grants |
| --- | --- |
| read:accounting | Read journals, entries and reports |
| write:accounting | Post entries and payments |
| read:sales | Read customers, quotations and orders |
| write:sales | Create and confirm orders |
| read:inventory | Read products and stock |
Give each integration its own token. If one leaks or an integration is retired, you revoke a single token without disrupting the others.
Set an expiry on long-lived tokens and rotate on a schedule. Revoking a token takes effect immediately on the next request.