Authentication
Authenticate API requests with dashboard-generated API keys.
The B2 Systems API uses bearer API keys.
Authorization: Bearer b2_live_...API keys are generated in the B2 Systems dashboard by an organization owner. Keys are shown only once when created. Store them securely in your server-side environment or secret manager.
Do not put API keys in browser code, mobile apps, public repositories, logs, or client-side CRM scripts.
Example Request
curl https://api.b2systems.io/v1/usage \
-H "Authorization: Bearer $B2_API_KEY"Access Requirements
An API key can only be used when:
- API access is enabled for the organization.
- The organization's active, accepted plan includes the API capability used by the endpoint: Deal API, InFlow, or TrueSight.
- The key has not been deleted.
- The organization has billing status that allows API usage.
- The key has the required scope for the endpoint.
The accepted plan entitlement is the upper bound. A key's scopes can narrow access, but a key cannot enable a capability that is disabled for its organization. An administrator-proposed plan change does not alter API access until the organization accepts it and the change becomes effective.
Billing is an access safeguard rather than a product selector. If billing is canceled or missing, API requests are blocked until billing is restored. A managed broker with its own eligible subscription uses its own billing account. Without one, it falls back to the managing funder organization's eligible subscription and billing account while that relationship is active.
Key Rotation
If a key is exposed or no longer needed, delete it in the dashboard and create a new one.
Deleted keys stop working immediately. B2 Systems keeps backend audit history for traceability, but deleted keys are no longer visible or usable by the organization.
Updated 18 days ago