Skip to main content

​
Authentication

FinSync currently documents two authentication modes in the OpenAPI spec.

​
API key authentication

Most company-scoped endpoints expect an x-api-key header.
Use API keys for routes such as:
  • Client management
  • Account and balance operations
  • Operation creation and review
  • Company transaction and operation type lookups

​
Company keys vs. personal employee keys

Company API keys (Configuración > Equipo y acceso > Empleados > Claves API) authenticate the company. Audit logs do not attribute those calls to a person, and role permissions do not apply. An employee whose role includes Solicitar clave API personal (personal_api.create) can generate one personal key from the user menu → Claves API personales. Administrador includes this permission. Operador does not, unless you add it to the role. Personal keys authenticate that employee:
  • Audit logs record the employee’s email as the actor.
  • Requests go through the same RBAC checks as the dashboard: route permissions plus scoped client visibility. A missing permission returns 403.
  • Send the key as x-api-key or as a bearer token:
Each employee can hold one personal key (active or inactive). The employee can deactivate or delete it. An admin with Claves API de la empresa (api.manage) can revoke any employee key from the employee list. The key stops working when the employee is removed or the company is blocked.

​
Session / bearer authentication

Dashboard and external-portal routes use an Auth.js session cookie. A small set of portal export endpoints also accept Authorization: Bearer for an active external-access grant (see /api/external-client/history).
  • Generate separate API keys per integration or environment.
  • Never expose secrets in browser-only code or public repositories.
  • Rotate keys if you suspect they were shared or logged.
  • Check each endpoint’s security requirements in the generated API reference because some routes override the global auth scheme.