API keys

1. 1

   Open Settings → API keys

   The screen lists existing keys, their status, their scopes and their last call.

2. 2

   Name the key

   One name per use — “accounting sync”, “collection bot” — so you know what to revoke the day it matters.

3. 3

   Pick scopes and expiry

   Tick only what the integration needs. The default expiry is a year; a key with no expiry is possible, and easy to forget.

4. 4

   Copy the secret

   It is shown once, right after creation. It is stored nowhere: if it is lost, replace it with a new key.

• Scopes are the product's permissions — the same ones a custom role grants.
• A missing scope cannot be worked around: the call is refused with a 403, even where the endpoint exists.
• Capabilities an organization cannot hold are stripped on every call, not only at creation.
• A scope that depends on a module you do not hold stays closed until the module is active.

curl https://www.react-box.com/api/v1/invoices \
  -H "x-api-key: rbx_…"

• 20 usable keys per organization. A revoked or expired key does not count.
• Expiry from 1 to 730 days, or none at all.
• 120 requests per minute per key. Beyond that the API answers 429 with a retry-after header.
• Lists return 50 items per page, 200 at most.

• Disabling suspends the key without deleting it: the integration stops, the history stays readable.
• Revoking deletes the key for good, effective on the next call.
• Keys created by someone are disabled when they lose access to the organization.
• A suspended or deleted organization closes its keys along with its sessions.