Skip to main content

​
Authentication

FinSync currently documents two authentication modes in the OpenAPI spec.

​
API key authentication

Most company-scoped endpoints expect an x-api-key header. 
curl --request GET \
  --url "https://finsync.ar/api/clients" \
  --header "x-api-key: YOUR_API_KEY"
Use API keys for routes such as:
  • Client management
  • Account and balance operations
  • Operation creation and review
  • Company transaction and operation type lookups

​
Bearer authentication

Some superadmin routes expect a bearer token, typically a Supabase access token with the required allowlist checks. 
curl --request GET \
  --url "https://finsync.ar/api/superadmin/companies" \
  --header "Authorization: Bearer YOUR_ACCESS_TOKEN"
  • Generate separate API keys per integration or environment.
  • Never expose secrets in browser-only code or public repositories.
  • Rotate keys if you suspect they were shared or logged.
  • Check each endpoint’s security requirements in the generated API reference because some routes override the global auth scheme.