Base URL
All requests go to:/v1.
Authentication
Every request must include an API key, sent as a bearer token in theAuthorization header. Keys are scoped to one environment, so a test key only ever sees test data and a live key only ever sees live data. See Authentication.
Data conventions
These conventions hold across every endpoint, so you can rely on them without checking each field:- JSON only. Requests and responses use
application/json. - snake_case fields. For example
external_customer_id,created_at. - Amounts are integer minor units. A value of
10050in a EUR invoice means 100.50 EUR. There are no floating-point amounts, so you never lose precision in transit. - Currencies are lowercase ISO 4217 codes. For example
eur. - Timestamps are RFC 3339 in UTC. For example
2026-06-01T09:30:00Z. - Identifiers are opaque and prefixed. For example
inv_clx123abc456. Treat the whole string as a token: do not parse or build it yourself.
Pagination
List endpoints return a single page and a cursor to fetch the next one. Follow thenext_url in each response until it is null. See Pagination.
Errors
Any response that is not a2xx uses one small JSON envelope with a stable, machine-readable code you can branch on: