Skip to content

Authentication

The AbaNinja API uses Bearer token authentication. API tokens are the only supported authentication method.

Creating an API Token

API tokens can be created in any paid AbaNinja account under Settings > Automation > API Tokens.

  1. Navigate to Settings > Automation > API Tokens
  2. Click Create API Token
  3. Enter a name for the token
  4. Select the required scopes (see below)
  5. Optionally set an expiration date — tokens without an expiration date remain valid indefinitely (use at your own risk)
  6. Confirm and copy the generated token immediately — it cannot be displayed again

WARNING

For security reasons, only grant the scopes your integration actually needs.

Using the Token

Include the token in the Authorization header of every request:

bash
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
  https://api.abaninja.ch/accounts/{accountUuid}/documents/v2/invoices

Account UUID

Most API endpoints require the accountUuid path parameter. You can obtain it in two ways:

  • Via the UI: Navigate to Settings > API Tokens > Account Information in your AbaNinja account
  • Via the API: Call the GET /users/v2/me/accounts endpoint with your token

Scopes

Each API token requires specific scopes to access certain endpoints. The following scopes are available:

ScopeDescription
accountingAccount assignments, presets and tax timelines
accountsAccount management
customersCustomer documents (invoices, quotes, credit notes, delivery notes, contract notes)
financesBank accounts, bank files and payments
membersMembers, groups and memberships
productsProducts, product groups and suppliers
profileUser profile and account information
settingsApplication and document settings
suppliersSupplier documents (receipts, supplier credit notes)
time-trackingEmployees, activities, timestamps and contracts
warehouseWarehouse management, transactions and exports

Each endpoint in the API reference shows which scopes are required. Some endpoints may require multiple scopes.

Security Best Practices

  • Only grant the scopes your integration actually needs
  • Rotate tokens regularly
  • Use tokens with an expiration date whenever possible
  • Never expose tokens in client-side code or public repositories