How to manage API tokens

API tokens allow an integration or service account to call supported Flinq APIs with selected permissions.

Before you start

• Confirm that you have permission to manage API tokens in the current office.

• Prepare an approved secret manager for the token and choose the minimum permissions and expiry the integration requires.

Create a token

1. Open the user menu and select API Tokens.

2. Select Create New Token.

3. Enter a name that identifies the integration or purpose.

4. Choose an expiry period or custom expiry date.

5. Select only the API permissions the integration needs.

6. Create the token and copy the secret immediately.

Available permissions

The creation dialog shows the scopes available in the current deployment. These can include read access to offices, statements, balances, transactions, Books, bank accounts, interest pools and payment runs, plus write access for statement uploads. Optional-product scopes appear only where the related product and API surface are available. Token permissions do not create product, record or office access that the user does not otherwise have.

API and Microsoft 365 access

API tokens are one integration credential. A configured Microsoft 365 or MCP connection uses its own OAuth sign-in and permission checks; do not paste an API token into that sign-in flow. The operations exposed by each integration can differ, so confirm the approved interface and scopes before building against it.

Review and revoke tokens

The API Tokens page shows each token's permissions, expiry, last use and creation date. Delete a token immediately if it is exposed, no longer required or used by a retired integration. Update the consuming system with a replacement before revoking a token that is still needed.

Good practice

• Use a separate token for each integration.

• Prefer an expiry date and rotate tokens regularly.

• Grant the smallest permission set possible.

• Investigate unexpected recent use before revoking or rotating the token.