Authentication

Every request is authenticated with an organization API token. Mint one in the console, scope it to only what your integration needs, and send it as a bearer credential.

Send your organization API token as a bearer credential. Tokens are org-scoped and least-privilege — each carries only the scopes it was minted with. A token belongs to the organization (not the person who minted it) and stays valid until it is explicitly revoked (or until it expires, if an expiry was chosen at mint).

header

Authorization: Bearer bok_org_your_token

Scopes

account:readinvoices:readinvoices:proposepayments:readevent_feed:readwebhook_endpoints:manage

Your first request

Verify the token resolves to your organization:

curl

curl https://api.bankofbots.ai/api/ext/v1/ping \
  -H "Authorization: Bearer $BOB_API_TOKEN"

Was this page helpful?