An API key lets another system connect to your oboloo account through the oboloo API. This guide shows you how to create a key, test it in the API documentation, and refresh or delete it.

Before you start

Only users whose role gives access to API Authentication can create API keys. To check your access, see Viewing Your Access Rights. The API is available on any Plus plan. On the free plan, clicking Generate API Key opens the Upgrade to any Plus Plan window.

Create an API key

Open API Authentication

Go to Settings > API Authentication.

Name the key

Under Create an API key, enter a name in API Key Name that tells you what the key is for, for example the system you're connecting.

Click Generate API Key

The new key appears at the top of Your API Keys with the status Active.

Copy the key now

Click the copy icon next to the key and store it somewhere secure. The full key is shown only once: when you leave or refresh the page it's hidden, and you can't view it again.

📌 Important: If you lose a key, you can't get it back. Refresh it or create a new one, then update any integration that uses it.

Test your key in the API documentation

Open the API documentation

On the API Authentication page, click API Documentation. It opens in a new tab.

Enter your domain

Under Servers, enter the start of your oboloo web address in the domain box.

💡 Example: If your oboloo address is companyname.oboloo.app, enter companyname.

Authorise with your key

Click Authorize, paste your API key into the value box and click Authorize. Then close the window.

Run a test request

Expand an endpoint, for example Get list of suppliers under Suppliers, and click Try it out. Add any filters you want, then click Execute.

Check the response

If the key works, your data is returned in JSON format. If you see Unauthenticated, see Troubleshooting below.

Refresh or delete a key

Find the key

Go to Settings > API Authentication and find the key under Your API Keys.

Refresh or delete it

To replace the key with a new one, click the orange refresh icon and then Refresh Token in Confirm Token Refresh. Copy the new key straight away.

To remove the key, click the red bin icon and then Delete. Deleting can't be undone.

What happens next

  • You get a security alert: oboloo emails you each time a new API key is created on your account. If you don't recognise a key, delete it straight away.

  • The key doesn't expire: it keeps working until you refresh or delete it.

  • Refreshing replaces the key: the old key stops working, so update every integration that used it.

  • Requests run as you: anything done with the key uses your access in oboloo.

Troubleshooting

I see 'Unauthenticated' instead of data

  • Check that you pasted the whole key, with no spaces.

  • Check that the key hasn't been refreshed or deleted since you copied it.

  • Check the domain under Servers matches your oboloo address.

  • If you're still stuck, create a new key and authorise again.

I can only see asterisks instead of my key

Keys are hidden after you leave the page. Refresh the key or create a new one, and copy it straight away.

I can't see API Authentication in Settings

Your role doesn't give you access. Ask your oboloo administrator.

Related articles

📌 Need Further Help?
If you need further assistance, please contact your internal platform administrator for support. Otherwise please reach out to oboloo's support team. If you are unable to view the above area in the oboloo platform, please check your user permissions and access rights.