Create API Key

Create API key

curl --request POST \
  --url https://api.timbrix.mx/organizations/{organizationId}/api-keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Production API Key",
  "description": "Used for production server",
  "scopes": [
    "read:user",
    "write:webhooks"
  ],
  "rateLimitPerMinute": 60,
  "rateLimitPerHour": 1000,
  "allowedIps": [
    "192.168.1.1",
    "10.0.0.0/24"
  ],
  "expiresAt": "2025-12-31T23:59:59Z"
}
'

import requests

url = "https://api.timbrix.mx/organizations/{organizationId}/api-keys"

payload = {
    "name": "Production API Key",
    "description": "Used for production server",
    "scopes": ["read:user", "write:webhooks"],
    "rateLimitPerMinute": 60,
    "rateLimitPerHour": 1000,
    "allowedIps": ["192.168.1.1", "10.0.0.0/24"],
    "expiresAt": "2025-12-31T23:59:59Z"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Production API Key',
    description: 'Used for production server',
    scopes: ['read:user', 'write:webhooks'],
    rateLimitPerMinute: 60,
    rateLimitPerHour: 1000,
    allowedIps: ['192.168.1.1', '10.0.0.0/24'],
    expiresAt: '2025-12-31T23:59:59Z'
  })
};

fetch('https://api.timbrix.mx/organizations/{organizationId}/api-keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.timbrix.mx/organizations/{organizationId}/api-keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Production API Key',
    'description' => 'Used for production server',
    'scopes' => [
        'read:user',
        'write:webhooks'
    ],
    'rateLimitPerMinute' => 60,
    'rateLimitPerHour' => 1000,
    'allowedIps' => [
        '192.168.1.1',
        '10.0.0.0/24'
    ],
    'expiresAt' => '2025-12-31T23:59:59Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.timbrix.mx/organizations/{organizationId}/api-keys"

	payload := strings.NewReader("{\n  \"name\": \"Production API Key\",\n  \"description\": \"Used for production server\",\n  \"scopes\": [\n    \"read:user\",\n    \"write:webhooks\"\n  ],\n  \"rateLimitPerMinute\": 60,\n  \"rateLimitPerHour\": 1000,\n  \"allowedIps\": [\n    \"192.168.1.1\",\n    \"10.0.0.0/24\"\n  ],\n  \"expiresAt\": \"2025-12-31T23:59:59Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.timbrix.mx/organizations/{organizationId}/api-keys")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Production API Key\",\n  \"description\": \"Used for production server\",\n  \"scopes\": [\n    \"read:user\",\n    \"write:webhooks\"\n  ],\n  \"rateLimitPerMinute\": 60,\n  \"rateLimitPerHour\": 1000,\n  \"allowedIps\": [\n    \"192.168.1.1\",\n    \"10.0.0.0/24\"\n  ],\n  \"expiresAt\": \"2025-12-31T23:59:59Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.timbrix.mx/organizations/{organizationId}/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Production API Key\",\n  \"description\": \"Used for production server\",\n  \"scopes\": [\n    \"read:user\",\n    \"write:webhooks\"\n  ],\n  \"rateLimitPerMinute\": 60,\n  \"rateLimitPerHour\": 1000,\n  \"allowedIps\": [\n    \"192.168.1.1\",\n    \"10.0.0.0/24\"\n  ],\n  \"expiresAt\": \"2025-12-31T23:59:59Z\"\n}"

response = http.request(request)
puts response.read_body

POST

organizations

{organizationId}

api-keys

Create API key

curl --request POST \
  --url https://api.timbrix.mx/organizations/{organizationId}/api-keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Production API Key",
  "description": "Used for production server",
  "scopes": [
    "read:user",
    "write:webhooks"
  ],
  "rateLimitPerMinute": 60,
  "rateLimitPerHour": 1000,
  "allowedIps": [
    "192.168.1.1",
    "10.0.0.0/24"
  ],
  "expiresAt": "2025-12-31T23:59:59Z"
}
'

import requests

url = "https://api.timbrix.mx/organizations/{organizationId}/api-keys"

payload = {
    "name": "Production API Key",
    "description": "Used for production server",
    "scopes": ["read:user", "write:webhooks"],
    "rateLimitPerMinute": 60,
    "rateLimitPerHour": 1000,
    "allowedIps": ["192.168.1.1", "10.0.0.0/24"],
    "expiresAt": "2025-12-31T23:59:59Z"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Production API Key',
    description: 'Used for production server',
    scopes: ['read:user', 'write:webhooks'],
    rateLimitPerMinute: 60,
    rateLimitPerHour: 1000,
    allowedIps: ['192.168.1.1', '10.0.0.0/24'],
    expiresAt: '2025-12-31T23:59:59Z'
  })
};

fetch('https://api.timbrix.mx/organizations/{organizationId}/api-keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.timbrix.mx/organizations/{organizationId}/api-keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Production API Key',
    'description' => 'Used for production server',
    'scopes' => [
        'read:user',
        'write:webhooks'
    ],
    'rateLimitPerMinute' => 60,
    'rateLimitPerHour' => 1000,
    'allowedIps' => [
        '192.168.1.1',
        '10.0.0.0/24'
    ],
    'expiresAt' => '2025-12-31T23:59:59Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.timbrix.mx/organizations/{organizationId}/api-keys"

	payload := strings.NewReader("{\n  \"name\": \"Production API Key\",\n  \"description\": \"Used for production server\",\n  \"scopes\": [\n    \"read:user\",\n    \"write:webhooks\"\n  ],\n  \"rateLimitPerMinute\": 60,\n  \"rateLimitPerHour\": 1000,\n  \"allowedIps\": [\n    \"192.168.1.1\",\n    \"10.0.0.0/24\"\n  ],\n  \"expiresAt\": \"2025-12-31T23:59:59Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.timbrix.mx/organizations/{organizationId}/api-keys")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Production API Key\",\n  \"description\": \"Used for production server\",\n  \"scopes\": [\n    \"read:user\",\n    \"write:webhooks\"\n  ],\n  \"rateLimitPerMinute\": 60,\n  \"rateLimitPerHour\": 1000,\n  \"allowedIps\": [\n    \"192.168.1.1\",\n    \"10.0.0.0/24\"\n  ],\n  \"expiresAt\": \"2025-12-31T23:59:59Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.timbrix.mx/organizations/{organizationId}/api-keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Production API Key\",\n  \"description\": \"Used for production server\",\n  \"scopes\": [\n    \"read:user\",\n    \"write:webhooks\"\n  ],\n  \"rateLimitPerMinute\": 60,\n  \"rateLimitPerHour\": 1000,\n  \"allowedIps\": [\n    \"192.168.1.1\",\n    \"10.0.0.0/24\"\n  ],\n  \"expiresAt\": \"2025-12-31T23:59:59Z\"\n}"

response = http.request(request)
puts response.read_body

Creates a new API key for programmatic access.

Permissions

User must be owner or admin.

Security

API keys are prefixed with sk_
Full key value is only shown once during creation
Store the key securely (never commit to git)
Keys are hashed before storage

Using API Keys

Include the API key in the X-API-Key header:

curl -X GET https://api.timbrix.mx/organizations/acme-corp \
  -H "X-API-Key: sk_..."

Example

curl -X POST https://api.timbrix.mx/organizations/acme-corp/api-keys \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production API Key",
    "description": "Key for production server"
  }'

Best Practices

Use descriptive names for keys
Create separate keys for different environments
Rotate keys regularly
Revoke unused keys immediately

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

organizationId

string

required

Body

application/json

name

string

required

API key name

Required string length: 3 - 50

Example:

"Production API Key"

description

string

API key description

Maximum string length: 200

Example:

"Used for production server"

scopes

enum<string>[]

API key scopes (permissions). Defaults to ['read:user'] if not provided

Available options:

read:user,

write:user,

read:organization,

write:organization,

read:members,

write:members,

read:webhooks,

write:webhooks,

read:api-keys,

write:api-keys,

read:invoices,

write:invoices

Example:

["read:user", "write:webhooks"]

rateLimitPerMinute

number

Rate limit per minute

Required range: 1 <= x <= 10000

Example:

60

rateLimitPerHour

number

Rate limit per hour

Required range: 1 <= x <= 100000

Example:

1000

allowedIps

string[]

Allowed IP addresses (CIDR notation supported)

Example:

["192.168.1.1", "10.0.0.0/24"]

expiresAt

string

Expiration date

Example:

"2025-12-31T23:59:59Z"

Response

API key created successfully. Save the plain key securely!

API documentation

Organizations

Members

Invites

Auth

OAuth

Customers

SAT Catalogs

Invoices

Products

Users

Webhooks

API Keys

Permissions

Security

Using API Keys

Example

Best Practices

Authorizations

Path Parameters

Body

Response

​Permissions

​Security

​Using API Keys

​Example

​Best Practices

Authorizations

Path Parameters

Body

Response

Permissions

Security

Using API Keys

Example

Best Practices