Support / Developer API
Your books, programmable
Everything Bokeping knows about your business, over a clean REST API — invoices, contacts, bills, accounts, and reports.
REST + JSON
Predictable resource URLs, standard HTTP verbs, JSON in and out. If you’ve used one good API, you already know this one.
snake_case everywhere
Every field on the wire is snake_case — requests, responses, and webhook payloads. No guessing, no mixed conventions.
Keys you control
Create and revoke API keys yourself in Settings. Scope them to what a script actually needs, and rotate without a support ticket.
Signed webhooks
Get notified when invoices are paid or bank activity lands. Every payload is signed so you can verify it really came from us.
First request
One curl away from your ledger
curl https://api.bokeping.com/v1/invoices \
-H "Authorization: Bearer bk_live_9f2…"
{
"data": [
{
"id": 1042,
"invoice_no": "INV-01042",
"customer_id": 88,
"invoice_date": "2026-08-01",
"due_date": "2026-08-31",
"currency_code": "USD",
"total": "1250.00",
"due_amount": "0.00",
"status": "paid"
}
],
"pagination": { "page": 1, "page_size": 25, "total": 214 }
}Authentication
One header, keys you own
Keys live in Settings
Create API keys yourself under Settings → API keys. No support ticket, no waiting — a key exists the moment you need one.
One header, every request
Send the key as a Bearer token in the Authorization header. That’s the entire handshake — no OAuth dance for your own data.
Scope each key to its job
A reporting dashboard doesn’t need to create invoices. Give every script exactly the access it uses, so a leaked key can only do what that script could.
Rotate without downtime
Create the replacement key, deploy it, revoke the old one. Revocation is immediate — and keys belong on your server, never in client code or a repo.
# Every request carries the key — nothing else to set up
curl https://api.bokeping.com/v1/accounts \
-H "Authorization: Bearer bk_live_9f2…"
# A revoked or unknown key fails loudly, not quietly
{
"status_code": 401,
"code": "INVALID_API_KEY",
"message": "The API key is invalid or has been revoked."
}Endpoints
The resources you’d expect
| Endpoint | What you can do |
|---|---|
| /invoices | List, create, and send invoices; record payments against them. |
| /contacts | Customers and vendors — create, update, and look up balances. |
| /bills | Track what you owe and record bill payments. |
| /accounts | Read your chart of accounts, with live balances. |
| /reports | Pull Profit & Loss, Balance Sheet, and Cash Flow as structured JSON. |
Webhooks
Find out when it happens, not when you poll
{
"id": "evt_7c31a90d",
"type": "invoice.paid",
"created_at": "2026-08-06T14:12:09Z",
"data": {
"invoice_id": 1042,
"invoice_no": "INV-01042",
"total": "1250.00"
}
}Events, not polling
Subscribe an HTTPS endpoint to the moments you care about — an invoice getting paid, bank activity landing, a contact changing. Each delivery is a small JSON POST naming the event and the record it touched.
Verify the signature
Every payload is signed with your webhook secret, and the signature rides in a header. Verify it before trusting a single field — and reject anything that doesn’t check out.
Answer fast, work later
Return a 2xx quickly and do the real processing on your own time. If your endpoint is down or slow, we retry with increasing backoff until it recovers — deliveries are persistent, not fire-and-forget.
Expect repeats
Retries mean the same event can arrive more than once. Every event carries a stable id — record the ids you’ve processed and skip the ones you’ve seen. Idempotent handlers sleep well.
Rate limits & versioning
Built to not surprise you
Versioned via /v1
Every path starts with the version. Breaking changes only ever arrive behind a new version number — code written against /v1 keeps working.
Additive by default
New fields appear in responses as the product grows. Build parsers that ignore keys they don’t recognize, and additions will never break you.
Limits that stay out of the way
Rate limits are set generously for bookkeeping workloads — syncs, dashboards, nightly jobs. If you ever hit one, you’ll get a clear 429 with a Retry-After header. Back off and retry.
API FAQs
Fair questions from developers
Read-write. You can create and send invoices, add contacts, and record bills — the same actions the app takes, hitting the same double-entry ledger with the same audit trail. Reports are read-only by nature.
The Scale plan, at $99 a month. Bank feeds through Plaid stay read-only on every plan by design — that’s a property of the connection, not of your API key.
No — there is no separate sandbox environment today, and we would rather say so than point you at a workaround that isn’t one. Keys are issued for the company they belong to, on the Scale plan, so integrations are built against real books. Two things make that survivable: scope each key to exactly what the script needs, and remember corrections are append-only — a test invoice gets voided rather than deleted, and the audit trail keeps the whole story.
The contact page — bokeping.com/resources/contact — reaches the team that builds the API, not a tier of ticket triage. Include the request path and the response you got, and you’ll get a real answer back.
API access comes with the Scale plan
Everything above — plus unlimited team members, roles and permissions, and dedicated onboarding.
Ready to know your money?
We’re ready when you are. Free to start, up and running in minutes.