AUTOMATION & APIAvailable now · API Keys

Your financial data,one request away

Some tools you have to build yourself — the internal dashboard, the customer billing portal, the script that feeds your warehouse. Scoped CashFish API keys give your code the same records you see in the app, with only the permissions you grant.

Start your 4-day free trial

Internal dashboardsBilling portalsData pipelinesRetool & Grafana

Scale plan · $44/mo billed yearly ($529) · 4-day free trial · Full refund guarantee

01The tool that never got built

The dashboard your team wants
is three numbers wide.

It never gets built, because getting those three numbers out means someone exporting a file every Monday until the Monday they forget.

THE CSV

A weekly export that turns into a weekly chore

Download the file, paste it into the sheet the dashboard reads, fix the column that shifted. Miss one week and the chart carries on looking confident while quietly being wrong.

export → paste → repeat

THE PORTAL

Customers asking for a balance you already know

Your product has an account page. The invoice balance lives somewhere else entirely, so the page says nothing useful and support answers the same question all week.

balance: ask support

THE SCRIPT

One credential quietly doing five jobs

The same login ends up in a script, a dashboard and a colleague's notes. When it finally needs rotating, nobody can say with confidence what will break.

1 credential · 5 places

A key with one job is easy to reason about, easy to rotate and easy to switch off — which is the whole argument for scopes.

02What a key can reach

The same records
you see in the app.

Read what you need, write what you must, and nothing beyond it. Each key carries only the scopes you tick, and can be pinned to an IP allowlist so it works from your servers and nowhere else.

Both directions, your call. Your code calls CashFish over HTTPS with exactly the scopes you grant per key — and a revoked key stops working immediately.

Invoices & receivablesread outstanding balances or create invoice records straight from your own code

Expenses & paymentsquery, filter and write entries under scoped read or write permissions

Clients & contactsthe same client list you see in the app, one GET request away

Reports & cashflow figurespull summaries into dashboards built on Retool, Grafana or your own stack

Request audit trailevery call logged with timestamp and source IP against the key that made it

Up to 10 active keys per account, rate-limited to 500 requests per minute across the account — traffic arriving through Zapier counts against the same limit. A key is shown once at creation and stored hashed after that.

03What fires, and what it carries

Five calls,
five narrow permissions.

What a modest internal tool actually asks for: the call, the scope it needs to be allowed to make it, and what comes back into the screen your team opens.

GET /v1/invoices?status=openREAD

invoice number
client
balance + due date

The receivables panel of your internal dashboard

invoices:read

GET /v1/reports/cashflowREAD

money in, money out
period totals
closing position

The three numbers your Monday meeting opens with

reports:read

POST /v1/expensesWRITE

amount
vendor + category
receipt reference

An expense entry, duplicate-checked like any other

expenses:write

POST /v1/invoicesWRITE

client id
line items
due date

An invoice record raised by your billing script

invoices:write

GET /v1/clientsREAD

client id
name
first document seen

The customer portal's account page

clients:read

Each key carries only the scopes on its own row, is logged on every call with a timestamp and source IP, and can be revoked in settings at any time — the next request with it gets a 401 and the other keys carry on untouched.

04What changes

Least privilege,
and a log to prove it.

Three things that are different once each tool holds its own key — with the numbers each one actually produces.

Least privilege, by default

Give the reporting tool a read-only key, the billing script a write scope, and pin each to an IP allowlist. Revoking one never touches the others.

reports:readinvoices:writeIP allowlist · 2 addresses

A dashboard shaped like your business

Pull the three numbers your Monday meeting actually opens with — straight from the API into the internal tool your team already uses.

Outstanding receivables$6,400

Collected this month$9,200

Approved expenses$2,750

Every call accounted for

Requests are logged with timestamps and source IPs, so when something looks off you can trace exactly which key did what, and when.

GET /v1/invoicesreporting-ro · 09:14200

POST /v1/expensesops-writer · 09:31201

GET /v1/reports/cashflowdash-ro · 09:45200

05Three steps to wired

Set it up once.
Then let it run.

Name the key for its job, tick the scopes it needs, prove it against the sandbox, then point production at it.

Create a scoped key

In Settings → Developer → API Keys, name the key for its job, pick its permission scopes, and optionally add an IP allowlist. Copy it right away — it's shown once and stored hashed.

Authenticate over HTTPS

Send the key as a Bearer token in the Authorization header on every request. Plain HTTP is rejected outright, so nothing travels unencrypted.

Test in the sandbox, then ship

Use a separate sandbox key against the isolated sandbox environment — its data never mixes with your live account, and you can reset it whenever you like.

Bearer API key over HTTPS — scoped permissions, instant revocation

Revocation takes effect on the next request — a 401, and nothing more. For a rotation with no downtime, deploy the replacement key first and revoke the old one afterwards. Data is protected with 256-bit encryption under SOC 2 Type II, ISO 27001 and GDPR, and every connection can be reviewed or disconnected from the Connection Health panel in settings.

06Wires well with

One automation
is rarely the whole loop.

Webhooks

Signed JSON delivered to your endpoint within seconds of a record changing.

Zapier

One connection key, 1,000+ apps — orders, won deals and form entries arriving as finished records.

Stripe

Card takings and payouts read in as records from the Growth plan up.

Salesforce

Accounts and closed opportunities matched to the paperwork behind them.

Duplicate detection runs across every source, so the same sale arriving through an automation and through an emailed receipt is recorded once. Accounting sync with QuickBooks and Xero is a one-way import into CashFish — your accounting file stays the ledger and is never written to. Shopify is in private beta and available by request only.

07The plan for this

Scoped access,
on Scale and Teams.

Scale is the plan on this page because the custom API, its scopes and the request log belong to it, alongside webhooks, advanced forecasting, profitability by client and vendor and contract intelligence with renewal alerts.

API keys, scopes and the request log come with Scale and above; email and document extraction work from Starter.

$44/mo billed yearly ($529) · or $59/mo monthly

Start your 4-day free trial Start monthly at $59/mo

4-day free trial · Full refund guarantee

Your subscription begins after the 4-day trial unless canceled beforehand. Full refund guarantee within the first 4 days.

Compare all plans →

Build the tool your team keeps wishing existed. Scoped keys are included with Scale and Teams. Generate one in settings and make your first authenticated call today.

08Straight answers

What people ask
before they wire up API Keys.

Keys support invoices:read, invoices:write, clients:read, clients:write, expenses:read, expenses:write, payments:read, reports:read, and account:admin. Combine several on one key, or issue narrow single-purpose keys so each integration holds only what it needs.