Skip to main content
Every Sync2Books API request authenticates with an API key sent in the X-API-Key header. This single mechanism is shared across all products — Expenses, eTIMS compliance, sync, attachments. Learn it once and it applies everywhere.
There is no /v1 path prefix and no separate auth endpoint. You authenticate on every request by setting headers. The base URL is https://api.sync2books.com. See Environments & base URLs.

Credentials at a glance

When you create an application in the dashboard, each environment (Development and Production) is issued a set of credentials:
The client secret (cs_…) and webhook secret (whsec_…) are sensitive. Never embed them in browser or mobile code. The API key is less sensitive but should still be kept server-side in production.

Step 1 — Get your API key

  1. Sign in to the Sync2Books Dashboard.
  2. Open your application and go to API Keys.
  3. Toggle between Development and Production and copy the key. Use Development while building.

Step 2 — Authenticate a request

Send the key in the X-API-Key header on every call:
That is all most integrations need. The signature below is optional.

Step 3 — (Optional) Sign your requests

For stronger security you may sign each request with your client secret. When you send the signature headers, the API validates them; if you omit them, the API key alone authenticates. The signed message is the concatenation, with no separators:
  • METHOD — uppercase HTTP method, e.g. POST
  • PATH — request path, e.g. /companies/abc/integrations/etims/sales
  • BODY — the exact JSON request body (empty string for GET)
  • TIMESTAMP — the same value you send in X-Timestamp
The signed BODY must be byte-for-byte identical to what you send. If your HTTP client re-serializes the JSON, sign the exact serialized string you transmit.

Authentication errors

See Errors & rate limits for the full error model.

Next steps

Companies & connections

Model your customers and link their accounting systems.

The sync model

Understand sync batches and the asynchronous result flow.

Environments & base URLs

Development vs production, and the correct base URL.

Errors & rate limits

Status codes, error shape, and throttling headers.