# Choose your integration

LedgerBee serves two kinds of integrator. The credential you hold decides which
endpoints answer: a company's credential reaches that company's data, and an
advisor firm's connection reaches the firm's client list.

| Your situation | Who connects | Credential | Endpoints | Start here |
|---|---|---|---|---|
| You integrate your own company | The company | API key, or OAuth2 client credentials | `/v1/*` outside `/v1/advisor` | [API Keys](/guides/api-keys) |
| You build a product that many companies connect to | Each company, through consent | Connected app (authorization code, PKCE) | `/v1/*` outside `/v1/advisor` | [Connected Apps](/guides/connected-apps) |
| You build a product for accounting firms | The firm, through a firm admin's consent | Connected app with `advisor-*` scopes | `/v1/advisor/*` | [Advisor firms](/guides/advisor-firms/overview) |

## One app, both kinds

A connected app that LedgerBee registers for both companies and advisor firms
can request scopes of both families in one authorize request. The person
approving chooses whether to connect a company or their advisor firm, and the
grant holds only the scopes of the family they chose.

Read `scope` in the token response to learn which one you received. A token
whose scopes start with `advisor-` acts for a firm; any other token acts for a
company.

## Telling endpoints apart

Every operation in the [API Reference](/api) opens with a **Credential** line
naming the kind of credential it accepts. Operations that take neither an API
key nor an OAuth token, such as the OAuth discovery documents or uploading
through a minted upload link, carry none.

A credential of the wrong kind is refused before its scopes are checked: a
company credential on an advisor endpoint, or a firm token on a company
endpoint, answers `403` with this `code` and `details`:

```json
{
  "code": "PUBLIC_API_HOLDER_MISMATCH",
  "details": { "required": "advisor", "actual": "company" }
}
```

`required` is the kind the endpoint serves and `actual` is the kind you sent,
each `company` or `advisor`. The **Report usage** operation answers a firm
token with `401` instead.