Authentication

The Ledger dashboard issues a secret API key when you create an organization. Copy it when shown: Ledger stores only a hash. If you lose the key, rotate it in the dashboard. Send the key with every client API request:

Authorization: Bearer <LEDGER_API_KEY>
Content-Type: application/json

Keep the key in a server-side environment variable. Do not put it in browser or mobile code, a public repository, or a public docs example. Each key accesses one organization’s sandbox data. For local development, the API runs at http://127.0.0.1:3001. The hosted API is https://api.integrateledger.com. For example:

curl https://api.integrateledger.com/v1/customers \
  -H "Authorization: Bearer $LEDGER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customerId":"your-user-123"}'

The API returns 401 for a missing or invalid key. The Stripe webhook endpoint uses Stripe’s signature instead of this key and is not a client API operation.

Getting started

Concepts

About

Authentication