Connect your own software with the API

Give software you run or build its own key to your books, decide what it can do, and switch it off in one click.

What this is

Software you run or build — a script, an internal tool, or something you're building yourself — can read and work in your books with a key of its own, without using anyone's password. If what you want to connect is an AI assistant such as Claude or ChatGPT, use Connected AI tools instead.

Creating a key

Create a key from Settings → API keys. Only an Owner can create or revoke one. Give it a name — usually the name of the software that will use it, so you recognize it later. Choose read-only access, or read and write. Choose whether it can see every business you run or only the ones you pick, and add an expiry date if you want it to stop working on its own.

You see the key once

The key itself is shown once, right when you create it. Copy it somewhere safe then — Nummio keeps only a fingerprint of it, never the key, and can't show it to you again. If you lose it, revoke it and create a new one; there's no way to look the old one up.

What a key can do

• Read: today's cash position and what's due, transactions and their detail, invoices and their detail, customers, vendors, the chart of accounts, the profit and loss, balance sheet, and trial balance, the A/R and A/P aging reports, the review queue, and the businesses the key can see.
• Write, when you chose read and write: add a customer, capture an expense, draft an invoice, send an invoice, record a payment against an invoice, accept a review-queue item, and send a payment reminder.

Every write a key makes is recorded in the audit log under the key's name, and the audit log can be filtered to API activity.

For the full reference — every endpoint, field by field — see the developer documentation.

What a key can never do

• Manage people or roles.
• Change billing.
• Create or revoke a key.
• Connect a bank.
• Lock or unlock a month.
• Delete anything.
• Reach another business's account.

Limits

• Foundation — 2 keys, up to 600 reads and 60 writes per key every ten minutes.
• Portfolio — 5 keys, up to 1200 reads and 120 writes per key every ten minutes.
• Holdings — 15 keys, up to 3000 reads and 300 writes per key every ten minutes.

A key won't send a second reminder for the same invoice within 24 hours, so it can't be asked to chase the same customer twice. A business in a read-only billing state, such as after a failed payment, can still read through a key — it just can't write until billing is sorted out.

Revoking a key

Revoke a key from Settings → API keys. It stops working immediately and cannot be undone — the software using it starts failing right away. The key stays in your history, marked revoked, so what it did is still on record.

Keeping keys safe

• Give each piece of software its own key — never share one key between two.
• Never put a key in a browser or a mobile app; either one can be read by whoever has the device.
• Never paste a key into a shared document, a chat, or a support ticket.
• Revoke anything you're not using. The page flags a key that has gone unused for 90 days.