Quickstart
Your first authenticated call in a few minutes.
Your first authenticated call in a few minutes: create an API client, exchange its credentials for a token, and read real data from your organization.
1. Create an API client
In Accountflow, open organization settings → integrations → API clients (https://next.accountflow.com) and create a client. You choose:
- Name and description — for your own bookkeeping.
- Environment — Production reads your organization's live data. Sandbox clients only work against the sandbox environment (coming soon) and can never touch production data.
- Scopes — grant the minimum the integration needs. Read scopes cover the data surfaces; write and management scopes are explicit opt-ins.
The dialog shows the client_id and client_secret exactly once — store
them in your secret manager before closing it. If a secret is lost, rotate the
client to get a new one; the old secret stops working immediately.
Creating and managing clients requires an organization administrator.
2. Mint a token
Bridge uses the standard OAuth2 client-credentials flow. Tokens are short-lived — fetch one per session or on expiry, not per request:
TOKEN=$(curl -s -X POST \
"https://auth.next.accountflow.com/realms/accountflow/protocol/openid-connect/token" \
-d grant_type=client_credentials \
-d client_id="$CLIENT_ID" \
-d client_secret="$CLIENT_SECRET" | jq -r .access_token)
3. Who am I?
curl -s https://api.next.accountflow.com/v1/whoami -H "Authorization: Bearer $TOKEN" | jq
{
"clientId": "com.accountflow.api.prod.4be9a1c803f2",
"mode": "SYSTEM",
"organizationId": "d290f1ee-6c54-4b01-90e6-d701748f0851"
}
Your tenant scope is derived from the credential itself — it is never a request parameter. Everything you can read or write lives under that organization.
4. List companies and read a ledger
curl -s https://api.next.accountflow.com/v1/companies -H "Authorization: Bearer $TOKEN" \
| jq '.data[] | {id, name}'
COMPANY=$(curl -s https://api.next.accountflow.com/v1/companies \
-H "Authorization: Bearer $TOKEN" | jq -r '.data[0].id')
curl -s "https://api.next.accountflow.com/v1/companies/$COMPANY/general-ledger/lines?page_size=50" \
-H "Authorization: Bearer $TOKEN" \
| jq '{lines: (.data | length), next: .pagination.next_cursor}'
Follow pagination.next_cursor until it is null — cursors are opaque, signed,
and bound to your client and filters (see Conventions). Try
the trial balance too: GET /v1/companies/{id}/trial-balance.
Things worth knowing before you build
- Every mutation requires an
Idempotency-Keyheader — retries are safe. - Errors are RFC 9457 problem documents with stable machine codes (catalog).
- Responses carry
RateLimit-*headers; on429, honorRetry-After. - A resource outside your scope answers 404, never 403 — absence and denial are indistinguishable by design.
Where next
- API reference — every endpoint, parameter and schema, generated from the same spec the server enforces.
- Conventions — pagination, idempotency, errors, rate limits, versioning.
- Error catalog — every error code, what it means, what to do.