How to manage API tokens

API tokens allow an integration or service account to call supported Flinq APIs with selected permissions.

Before you start

• Confirm that you have permission to manage API tokens in the current office.

• Prepare an approved secret manager for the token and choose the minimum permissions and expiry the integration requires.

Create a token

1. Open the user menu and select API Tokens.

2. Select Create New Token.

3. Enter a name that identifies the integration or purpose.

4. Choose an expiry period or custom expiry date.

5. Select only the API permissions the integration needs.

6. Create the token and copy the secret immediately.

Available permissions

The creation dialog shows the scopes available in the current deployment. These can include read access to offices, statements, balances, transactions, Books, bank accounts, interest pools and payment runs, plus write access for statement uploads. Optional-product scopes appear only where the related product and API surface are available. Token permissions do not create product, record or office access that the user does not otherwise have.

Review and revoke tokens

The API Tokens page shows each token's permissions, expiry, last use and creation date. Delete a token immediately if it is exposed, no longer required or used by a retired integration. Update the consuming system with a replacement before revoking a token that is still needed.

Good practice

• Use a separate token for each integration.

• Prefer an expiry date and rotate tokens regularly.

• Grant the smallest permission set possible.

• Investigate unexpected recent use before revoking or rotating the token.