API keys

An API key is the credential that lets your own systems read BankStmt data. Nothing can call the public API without one, so this screen is the starting point for any integration.

The secret is shown exactly once

When you create a key, the full secret appears in a one-time dialog. It is stored only as a SHA-256 hash, so nobody — including BankStmt support — can retrieve or re-display it afterwards. Copy it into your password manager or secret store before closing the dialog. If you lose it, the only remedy is to revoke the key and create a new one.

What it shows

API keys is a tab under Settings. It lists the keys issued for your account:

Column	What it holds
Name	The label you gave the key, so you can tell your integrations apart.
Key	A non-secret fragment — the leading characters and the last four — for identifying a key.
Scope	Read-only, or Read & write.
Last used	When the key last authenticated a request, or Never.
Status	Active, Revoked, or Expired.

Active keys have a revoke action at the end of the row.

Features

Feature	What it does
Create key	Issues a new key with a name and a scope, and shows the secret once.
Copy	Copies the one-time secret to the clipboard from the creation dialog.
Scopes	Restricts a key to reads, or allows it to upload statements as well.
Last-used tracking	Shows when each key was last used, so unused keys are easy to spot and retire.
Revoke	Disables a key immediately and permanently.

Scopes

Scope	Allows
Read-only	GET requests only — transactions, statements and summaries.
Read & write	The same reads, plus uploading statements.

Pick read-only unless the integration genuinely needs to upload. A read-only key that attempts a write is refused.

Status and expiry

• Active — the key is usable.
• Revoked — the key was revoked here and will never work again.
• Expired — the key had an expiry date and it has passed.

Keys created from this screen are issued without an expiry date: they stay usable until you revoke them. Rotating keys on a schedule of your own is good practice — create the replacement, deploy it, then revoke the old one.

How to use it

1. Open Settings → API keys.
2. Select Create key.
3. Give the key a name that identifies where it will be used, for example Production ETL.
4. Choose the scope: Read-only, or Read & write if the integration uploads statements.
5. Select Create. The secret is displayed once — copy it and store it somewhere safe now.
6. Close the dialog. From then on only the name, the key fragment, the scope and the usage information are visible.
7. Send the key on every request in the X-API-Key header. Endpoints, parameters and error codes are in the developer documentation, which requires a developer sign-in.

To retire a key, select the revoke action on its row and confirm. Any integration still using it stops working immediately.

Notes and limits

• The secret cannot be recovered. Only a hash is stored. Losing it means revoking and replacing.
• Revoking is immediate and cannot be undone. Requests made with a revoked key are rejected from that moment on.
• A key sees everything in your account. Scope controls read versus write, not which accounts, statements or categories are visible. Issue separate keys per integration so you can revoke one without disturbing the others.
• There is a cap on how many keys an account can hold (25). Revoke unused keys before creating more.
• Each key has its own per-minute request budget, and your plan's monthly page allowance applies to API traffic just as it does in the app. See Plans & limits.
• The key format begins with bsk_live_, which makes leaked keys recognisable to secret scanners. Never commit one to source control.