Appearance
Authentication
The AbaNinja API uses Bearer token authentication. API tokens are the only supported authentication method.
Creating an API Token
API tokens can be created in any paid AbaNinja account under Settings > Automation > API Tokens.
- Navigate to Settings > Automation > API Tokens
- Click Create API Token
- Enter a name for the token
- Select the required scopes (see below)
- Optionally set an expiration date — tokens without an expiration date remain valid indefinitely (use at your own risk)
- Confirm and copy the generated token immediately — it cannot be displayed again
WARNING
For security reasons, only grant the scopes your integration actually needs.
Using the Token
Include the token in the Authorization header of every request:
bash
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
https://api.abaninja.ch/accounts/{accountUuid}/documents/v2/invoicesAccount UUID
Most API endpoints require the accountUuid path parameter. You can obtain it in two ways:
- Via the UI: Navigate to Settings > API Tokens > Account Information in your AbaNinja account
- Via the API: Call the
GET /users/v2/me/accountsendpoint with your token
Scopes
Each API token requires specific scopes to access certain endpoints. The following scopes are available:
| Scope | Description |
|---|---|
accounting | Account assignments, presets and tax timelines |
accounts | Account management |
customers | Customer documents (invoices, quotes, credit notes, delivery notes, contract notes) |
finances | Bank accounts, bank files and payments |
members | Members, groups and memberships |
products | Products, product groups and suppliers |
profile | User profile and account information |
settings | Application and document settings |
suppliers | Supplier documents (receipts, supplier credit notes) |
time-tracking | Employees, activities, timestamps and contracts |
warehouse | Warehouse management, transactions and exports |
Each endpoint in the API reference shows which scopes are required. Some endpoints may require multiple scopes.
Security Best Practices
- Only grant the scopes your integration actually needs
- Rotate tokens regularly
- Use tokens with an expiration date whenever possible
- Never expose tokens in client-side code or public repositories