Authentication

API keys

Format: fxk_ followed by 48 hex characters.
Created and revoked by factory admins in System Settings → API access.
Shown once at creation. FactoraERP stores only a SHA-256 hash and the first 12 characters (for example fxk_1a2b3c4d) so you can tell keys apart. A lost key can't be recovered: revoke it and create a new one.
Each key belongs to one factory and can only read that factory's data.
Up to 20 active keys per factory.
Expiry: 30, 90 (default) or 365 days, or never. Expired and revoked keys stop working immediately.
The admin screen shows when a key was last used (updated at most once an hour).

Scopes

Scope	Grants
`read:customers`	`GET /api/v1/customers`
`read:inventory`	`GET /api/v1/inventory-items`
`read:sales`	`GET /api/v1/sales-invoices`

Sending the key

Use either header:

curl -H "Authorization: Bearer fxk_..." https://brazen-raven-302.convex.site/api/v1/me
curl -H "X-API-Key: fxk_..." https://brazen-raven-302.convex.site/api/v1/me

If both are present, Authorization wins. Never put the key in the URL: a request with an api_key query parameter is refused with 401 so keys don't leak into logs.

Keeping keys safe

Store keys in a secrets manager or environment variable, never in source code or front-end apps.
Give each integration its own key with only the scopes it needs.
Prefer an expiry and rotate keys before they lapse.