> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinksale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Blinksale API

# Authentication

The Blinksale API uses API tokens (also called API keys) for authentication. This page explains how to obtain and use API tokens to access the Blinksale API.

## Obtaining an API Token

To get your API token:

1. Log in to your Blinksale account
2. Navigate to **Settings → API Access** (or go directly to [https://app.blinksale.com/settings/api](https://app.blinksale.com/settings/api))
3. Click on "Create API Token"
4. Enter a name for your token (e.g., "My Integration")
5. Set permissions as needed
6. Click "Create" to generate the token
7. **Important**: Copy your token immediately and store it in a secure location. For security reasons, you won't be able to view the complete token again after closing the dialog.

<img src="https://mintcdn.com/theavenuesllc-ac00f1e1/hWDCAHwKDX9fe_FZ/images/api-tokens-list.png?fit=max&auto=format&n=hWDCAHwKDX9fe_FZ&q=85&s=dff2f37b208801b3e757f608e43856bd" alt="API Access Page" width="5634" height="3480" data-path="images/api-tokens-list.png" />

## Token Permissions

When creating an API token, you can specify the permissions for that token:

* **Read**: View resources but cannot create, update, or delete
* **Write**: Create, update, and delete resources (also includes read access)
* **Send**: Send emails (estimates, invoices, etc.)

Assign only the permissions necessary for your integration to follow security best practices.

## Using Your API Token

To authenticate API requests, include your API token in the `Authorization` header using the Bearer token scheme:

```
Authorization: Bearer YOUR_API_TOKEN
```

### Example Request with cURL

```bash theme={null}
curl -X GET \
  https://app.blinksale.com/api/v1/clients \
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
  -H 'Accept: application/json'
```

### Example Request with JavaScript

```javascript theme={null}
fetch('https://app.blinksale.com/api/v1/clients', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_TOKEN',
    'Accept': 'application/json',
  }
})
.then(response => response.json())
.then(data => console.log(data));
```

### Example Request with PHP

```php theme={null}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://app.blinksale.com/api/v1/clients');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer YOUR_API_TOKEN',
    'Accept: application/json',
]);
$response = curl_exec($ch);
curl_close($ch);
echo $response;
```

## Token Security Best Practices

1. **Never share or expose your API token** in public code repositories, client-side code, or insecure locations.

2. **Store tokens securely** in environment variables or a secure credential store, not directly in your code.

3. **Use specific tokens for specific integrations** so you can revoke access individually if needed.

4. **Periodically rotate your API tokens** to minimize risk in case a token is compromised.

5. **Grant only the required permissions** to each API token following the principle of least privilege.

6. **Revoke tokens that are no longer needed** to minimize potential attack surface.

## Token Management

You can manage your API tokens from the API Access settings page:

* **View**: See a list of all your active API tokens
* **Create**: Generate new API tokens for different integrations
* **Delete**: Remove tokens that are no longer needed
* **Rotate**: Replace an existing token with a new one when needed

If you believe an API token has been compromised, delete it immediately and create a new one with the same permissions.