API keys and apps

With an API key, an app, script or AI assistant can work with your invoices on your behalf. You manage keys under Settings → API & AI. API keys are included in every plan.

Creating a key

1. Under API keys, click New key.
2. Give it a name, so you know where you use it (for example "Claude Desktop" or "Accounting sync").
3. Choose when it Expires: in 30 days, 90 days, 1 year or never.
4. Click Create key and copy the key. It starts with efm_.

You only see the key once; we only store a hashed version. Lost it? Revoke it and create a new one. While the page stays open, your new key is already filled in in the examples under Connect your AI assistant.

The list shows for each key when it was created, when it was last used and when it expires.

Using a key

Send it in the header of every request:

curl https://eenfactuurmaken.nl/api/v1/me \
  -H "Authorization: Bearer efm_your_key"

Or, if your tool can't send Bearer tokens: X-API-Key: efm_your_key. More in Authentication.

What can a key do?

A key has the same access to your invoices, customers, products and settings as you have in the app. A few things only work in the web app, to protect you if a key leaks:

• changing your IBAN, BIC, account holder name, reply-to address and default payment link;
• starting, cancelling or resuming your subscription;
• security: password, 2FA, passkeys, devices, the security log and the API keys themselves;
• deleting your account.

A key may make 120 requests a minute.

Revoking

Click Revoke next to a key. Apps using it lose access immediately. This can't be undone.

When you change your password, you can choose to revoke all your API keys and connected apps at the same time.

Treat a key like a password

Never put it in code that runs in a browser, in a public repository or in a shared document. Use a password manager or your server's secrets store.

Connected apps (OAuth)

If you connect ChatGPT, Claude or another AI app through OAuth (signing in instead of pasting a key), that app appears under Connected apps. You see which app it is and when you gave it access.

Disconnect revokes that app's access immediately. The app then has to ask for permission again. More about OAuth in MCP server.