X-API-Key
header. This single mechanism is shared across all products — Expenses, eTIMS
compliance, sync, attachments. Learn it once and it applies everywhere.
There is no
/v1 path prefix and no separate auth endpoint. You authenticate
on every request by setting headers. The base URL is
https://api.sync2books.com. See Environments & base URLs.Credentials at a glance
When you create an application in the dashboard, each environment (Development and Production) is issued a set of credentials:Step 1 — Get your API key
- Sign in to the Sync2Books Dashboard.
- Open your application and go to API Keys.
- Toggle between Development and Production and copy the key. Use Development while building.
Step 2 — Authenticate a request
Send the key in theX-API-Key header on every call:
Step 3 — (Optional) Sign your requests
For stronger security you may sign each request with your client secret. When you send the signature headers, the API validates them; if you omit them, the API key alone authenticates.
The signed
message is the concatenation, with no separators:
METHOD— uppercase HTTP method, e.g.POSTPATH— request path, e.g./companies/abc/integrations/etims/salesBODY— the exact JSON request body (empty string for GET)TIMESTAMP— the same value you send inX-Timestamp
Authentication errors
See Errors & rate limits for the full error model.
Next steps
Companies & connections
Model your customers and link their accounting systems.
The sync model
Understand sync batches and the asynchronous result flow.
Environments & base URLs
Development vs production, and the correct base URL.
Errors & rate limits
Status codes, error shape, and throttling headers.