Authentication
Fiscalapi authenticates every HTTP request with two values. Your tenant (the space in Fiscalapi that holds your issuers, recipients, credits, and data) identifies you, and your API key authorizes the request. This guide shows how to send them.
Required HTTP headers
Include these two headers in every API request:
| Header | Value |
|---|---|
X-TENANT-KEY | Unique identifier of your tenant in Fiscalapi. |
X-API-KEY | API key that authenticates the request. |
An API key stays active until you revoke it in the dashboard. If you suspect that one of your API keys has leaked, revoke it right away to protect your resources.
Authenticate requests with the API key and tenant
To access a protected resource, send your API key and tenant in the headers above. This example uses Create an income invoice (POST /api/v4/invoices) to create an income (I) invoice, the regular sales invoice.
Request
curl --location 'https://test.fiscalapi.com/api/v4/invoices' \
--header 'X-TENANT-KEY: <my-tenant>' \
--header 'X-TIME-ZONE: America/Mexico_City' \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: <my-api-key>' \
--data '{
"versionCode": "4.0",
"series": "F",
"date": "2025-04-17T08:56:40",
"paymentFormCode": "01",
"paymentMethodCode": "PUE",
"currencyCode": "MXN",
"typeCode": "I",
"expeditionZipCode": "42501",
"exchangeRate": 1,
"exportCode": "01",
"issuer": {
"id": "78d380fd-1b69-4e3c-8bc0-4f57737f7d5f"
},
"recipient": {
"id": "bef56254-0892-4558-95c3-f9c8729e4b0e"
},
"items": [
{
"id": "310301b3-1ae9-441b-b463-51a8f9ca8ba2",
"quantity": 9.5,
"discount": 25.85
}
]
}'
Using the SDKs
The official SDKs (.NET, Node.js, Python, PHP, and Java) send the authentication headers for you. Set the tenant and API key once, when you create the client, as in the examples above.