An API key is a credential for the whole account. Treat it like a password. Only an Admin can issue or revoke one. Standard members can see the inventory. There is no delete — you Revoke.
Before you start
- Sign in as an Admin.
- Open Settings → API & webhooks.
- Have a short name ready for the integration (the field placeholder is “What is it for? e.g. Zapier”).
Issue a key
- Under Issue a key, tick only the scopes this integration needs. The checkboxes use the API names: Read debtors (
debtors:read), Create debtors (debtors:write), Read invoices (invoices:read), Create invoices (invoices:write), Read payments (payments:read), Record payments (payments:write), and Read the message log (messages:read). The product nav says Customers; the API still usesdebtors:*. Read and write are separate on purpose. - Type a name (required, up to 80 characters).
- Press Issue key.
- Copy the secret immediately. The help text says PayBlah stores only a hash of this key, so this is the only time it can be shown. Use Copy beside the secret if you want the clipboard helper.
Expected result
A flash reads “Key issued. Copy it now — it cannot be shown again.” The secret appears once. After you leave the pane, the table shows name, what it can do, last used (or Never), and only a prefix. The foot says only the prefix is recoverable.
Use the key
Call the public REST API with the secret as a Bearer credential: Authorization: Bearer plus the secret you copied. Keep it on a server you control. Never embed it in a customer-facing page, a ticket, or chat. Do not invent or publish sample keys.
A key whose scopes have all been narrowed can only prove itself — for example GET /api/v1/me. See API basics and rate limits.
Revoke
- On the key row, press Revoke.
Revocation is immediate. The next call returns 401 Unauthorized. PayBlah stamps the key revoked; it does not delete the record. If a secret is lost or leaked, issue another key, point the integration at the new one, then revoke the old one. There is no way to show the old secret again.
If something goes wrong
- Standard members see the list and: “Only an Admin can issue or revoke API keys.” Ask an Admin. If a key looks unexpected (label, scopes, or last used), ask an Admin to revoke it.
- Empty name: “Give the key a name, so you can tell it apart from the next one.”
- No scopes: “Choose at least one thing the key may do — a key with no scopes can do nothing but prove itself.”
- Lost secret: issue a new key, then Revoke the old one. Do not ask Support to recover the secret — it is not stored.
PayBlah does not provide a native Zapier connection or hold Zapier credentials. A narrowly scoped key plus a signed webhook can still be used in your own Zapier workflow.