Choose your integration
LedgerBee serves two kinds of integrator. The credential you hold decides which endpoints answer: a company's credential reaches that company's data, and an advisor firm's connection reaches the firm's client list.
| Your situation | Who connects | Credential | Endpoints | Start here |
|---|---|---|---|---|
| You integrate your own company | The company | API key, or OAuth2 client credentials | /v1/* outside /v1/advisor | API Keys |
| You build a product that many companies connect to | Each company, through consent | Connected app (authorization code, PKCE) | /v1/* outside /v1/advisor | Connected Apps |
| You build a product for accounting firms | The firm, through a firm admin's consent | Connected app with advisor-* scopes | /v1/advisor/* | Advisor firms |
One app, both kinds
A connected app that LedgerBee registers for both companies and advisor firms can request scopes of both families in one authorize request. The person approving chooses whether to connect a company or their advisor firm, and the grant holds only the scopes of the family they chose.
Read scope in the token response to learn which one you received. A token
whose scopes start with advisor- acts for a firm; any other token acts for a
company.
Telling endpoints apart
Every operation in the API Reference opens with a Credential line naming the kind of credential it accepts. Operations that take neither an API key nor an OAuth token, such as the OAuth discovery documents or uploading through a minted upload link, carry none.
A credential of the wrong kind is refused before its scopes are checked: a
company credential on an advisor endpoint, or a firm token on a company
endpoint, answers 403 with this code and details:
Code
required is the kind the endpoint serves and actual is the kind you sent,
each company or advisor. The Report usage operation answers a firm
token with 401 instead.