Authentication
The public API authenticates every request with an organization-scoped API token — never with the session cookie your browser uses when logged into the Relvo dashboard.
Authorization: Bearer rk_live_xxxxxxxxxxxxxxxxxxxxGetting a token
Sección titulada «Getting a token»Mint a token from the Developer Zone inside the Relvo dashboard (Settings → Developers → API keys). Only organization OWNER/ADMIN members can issue keys. The plaintext token (rk_live_…) is shown once, at creation — copy it immediately, Relvo does not store or redisplay it.
A token is bound to a single organization. Every endpoint scopes its results to that organization automatically — there is no organization_id parameter to pass, and no way for a token to read or write another organization’s data.
Each token is issued with one or more scopes, following a resource:action convention (e.g. contracts:read, invoices:write). A write scope on a resource implies read on that same resource — a token with contracts:write can also call contracts:read-gated endpoints.
full_access is a wildcard scope that passes every check. It’s convenient for a single internal integration but grants everything — prefer minting narrowly-scoped keys (e.g. just usage_events:write for a metering-only integration) so a leaked key has limited blast radius.
Each endpoint in the API Reference states the exact scope(s) it accepts.
Example
Sección titulada «Example»curl "https://app.relvoerp.com/api/v1/public/party/customers?limit=50" \ -H "Authorization: Bearer rk_live_xxxxxxxxxxxxxxxxxxxx"Common auth errors
Sección titulada «Common auth errors»| Status | Cause |
|---|---|
401 | Missing or malformed Authorization header |
403 | Token doesn’t carry a scope the endpoint requires |
403 | Token’s organization doesn’t own the resource being requested |