API Keys

API Keys

API keys provide programmatic access to the SuitePortal REST API. Keys are scoped to an organization and automatically apply row-level security.

Key Format

sp-{timestamp}-{hash}

Example:

sp-1703123456789-abc123def456

Key Properties

Creating API Keys

Via Dashboard

1. Navigate to Settings → API Keys
2. Click Create API Key
3. Enter a descriptive name (e.g., "Production Server", "Development")
4. Click Create
5. Copy the key immediately — it will not be shown again

Key Organization Scope

API keys are automatically associated with your active organization. The key inherits:

• organizationId — The organization the key belongs to
• tenantId — Derived from the organization for data access

Using API Keys

Authorization Header

Authorization: Bearer sp-1703123456789-abc123def456

cURL Example

curl -X GET "https://suiteportal.io/api/v1/invoices" \
  -H "Authorization: Bearer sp-1703123456789-abc123def456"

JavaScript/TypeScript

const response = await fetch('https://suiteportal.io/api/v1/invoices', {
  headers: {
    'Authorization': `Bearer ${process.env.SUITEPORTAL_API_KEY}`,
  },
});

Python

import requests

response = requests.get(
    'https://suiteportal.io/api/v1/invoices',
    headers={'Authorization': f'Bearer {os.environ["SUITEPORTAL_API_KEY"]}'}
)

Managing Keys

View Keys

1. Navigate to Settings → API Keys
2. View list of active keys

Displayed information:

• Key name
• Created date
• Last used
• Expiration status

Revoke Keys

1. Navigate to Settings → API Keys
2. Find the key to revoke
3. Click Revoke or Delete
4. Confirm the action

Revoked keys are immediately invalidated.

Key Expiration

Create new keys before expiration to maintain access.

Data Access

API keys inherit the organization's portal type for row-level security:

Security Best Practices

Do

• Store keys in environment variables
• Use different keys for development/staging/production
• Rotate keys periodically (e.g., monthly)
• Revoke keys when no longer needed
• Name keys descriptively (e.g., "CI/CD Pipeline", "Analytics Server")

Don't

• Commit keys to version control
• Share keys via email or chat
• Use the same key across multiple applications
• Log keys in application output
• Embed keys in client-side code

Environment Variables

Recommended environment variable naming:

# .env
SUITEPORTAL_API_KEY=sp-1703123456789-abc123def456

# Or with environment suffix
SUITEPORTAL_API_KEY_DEV=sp-...
SUITEPORTAL_API_KEY_PROD=sp-...

Troubleshooting

"API key required"

• Ensure Authorization header is present
• Check header format: Bearer sp-...

"Invalid API key"

• Key may be revoked or expired
• Verify key is copied correctly (no extra spaces)
• Create a new key if necessary

"Access denied"

• User who created the key may have been removed from organization
• Organization may have been deleted
• Contact administrator to verify membership

Related

• Authentication - Authentication overview
• API Overview - Using the REST API