To connect your own billing system to your payment platform, you create API keys in the platform's settings, give each one only the access it needs, and have your system send the secret with every request. Keys suit a business linking its own software to its own account. A platform that connects lots of other businesses' accounts uses OAuth instead.
In this article
The short version
- API keys connect your own system to your own account; platforms that connect many accounts use OAuth.
- Decide which records a system needs, whether it reads or writes, and how long the credential should last.
- In Adfin, admins create keys under Settings, Developers, API keys, with per-resource permissions and a 90-day, 180-day or 12-month expiry.
- Test with staging keys first and use the request logs to spot failed or unexpected calls.
- Keys can look up, list and create invoices, one-off payment requests and customers.
What an API key is and when you need one
An API (application programming interface) is the way one piece of software asks another for data or tells it to do something. API keys are long secret strings that prove the request comes from you. Your billing system sends the secret along with each request, the payment platform checks it, and the request runs with whatever access that credential was given.
You'll usually meet them when you bill from something your payment platform doesn't connect to out of the box: a job management system built years ago, an ERP, a membership database or a script a developer wrote for you. Without a connection, invoices and customer details get typed in twice, and mistakes follow.
It helps to know the difference between API keys and OAuth, because suppliers use both:
- API keys connect your own system to your own account. You create them, you hold them and you can revoke them.
- OAuth is for software that connects to many businesses' accounts. Each business approves the connection and can withdraw it later.
If you're a business wiring up your own billing system, keys are normally the right fit. If you're a software company offering an integration to your own customers, you'll want the supplier's OAuth or partner route.
What to decide before you create one
Most of these are business decisions, not technical ones.
- Which system will use it: name each credential after the system that holds it, such as "Job system" or "Data warehouse", so anyone can tell later what breaks if it's revoked.
- Which records it needs: a system that only creates invoices doesn't need to read your full customer list.
- Read or write: Read access lets a system look records up. Write access lets it create new ones. Give write access only where your system creates things.
- How long it should last: a shorter expiry suits a trial or a contractor's project. A longer one suits a stable, long-running integration, as long as someone owns the renewal.
- Who looks after it: pick the person who'll get the expiry reminders and update the system when the credential changes.
You'll also want somewhere safe to store the secret before you create it, ideally a secrets manager or an encrypted environment variable on the server that runs your integration. The UK's National Cyber Security Centre advises keeping secret credentials separate from source code, because exposed code repositories are a common way they leak.
How to set up API keys in Adfin
Adfin's API keys are included on every plan at no extra charge. They're for connecting your own systems to your own Adfin account. Admins with permission to manage keys create them in the Adfin console under Settings, then Developers, then API keys.
- Select Create API key and give it the name of the system that'll use it.
- Choose an expiry of 90 days, 180 days or 12 months.
- Pick permissions. For each resource you choose None, Read (look up and list) or Write (look up, list and create). Presets cover Full access, Read only and Custom.
- Create it, then copy the secret straight into your secrets manager. Adfin shows it once.
Your developer then sends it on each request in a standard header, "Authorization: Bearer" followed by the secret. Permissions can't be edited once set, so if a system needs more or less access, you create a new credential and revoke the old one.
Test first. Adfin has separate staging and production environments, and keys from one don't work in the other. Staging keys start adf_stg_ and production keys start adf_live_, which makes it easier to spot one in the wrong place.
Once you're live, the request logs under Settings, then Developers show each call's path, status, the credential used, the client IP address and how long it took. You can filter them to find failed requests or anything you don't recognise.
Adfin emails you 30, 7 and 1 day before a credential expires and adds a task to your dashboard. Rotating gives you a new secret with the same name and permissions, and the old one keeps working for 24 hours while you update your system. Keys unused for 60 days trigger a warning, and after 90 days unused Adfin revokes them automatically.
What you can and can't do with keys today
Adfin's API keys reach three areas: invoices, one-off payment requests, and customers with their contacts. With Read access your system can look these up and list them. With Write access it can also create them, so your billing system can send a new customer or invoice to Adfin as soon as it's raised.
They don't update, send or void existing records, mark invoices as paid, or reach direct debit mandates, recurring invoices, payouts or webhooks. If you need paid status back in your own system, plan for that separately, for example with a regular export.
If your system can email invoices but you'd rather not build anything, Adfin's invoice from email does a similar job without code: you Bcc or forward invoice emails to a dedicated Adfin address, Adfin reads each invoice, and its collection agents follow it up within rules you approve. You're responsible for keeping keys safe, so treat each one like a password.
Related guides
- How to keep API keys safe: a checklist for finance and operations teams
- Chasing invoices from a custom or in-house billing system
- Practice software stack: what actually needs to integrate
- Which accounting software works best for getting paid?
- Invoicing for UK businesses: a complete guide
Common questions
What's the difference between an API key and OAuth? API keys connect your own system to your own account. OAuth lets a third-party platform connect to many businesses' accounts after each one approves it.
Do I need a developer to use an API key? You'll usually need someone who can set up requests from your billing system, either a developer or a no-code tool that can send authenticated web requests. Creating the credential itself takes a few clicks.
Does Adfin charge for API keys? No. API keys are included on all Adfin plans at no extra charge.
How long does an Adfin API key last? You choose 90 days, 180 days or 12 months when you create it, and Adfin reminds you 30, 7 and 1 day before expiry.
Can I change a key's permissions later? No. Create a new one with the permissions you need, update your system, then revoke the old one.
Can I test an integration before going live? Yes. Create keys in Adfin's staging environment, which are separate from production keys and only work there.
Sources
- Adfin Developer Portal - API keys integration (accurate as of November 2026) https://developer.adfin.com/products/direct-integration/guides/get-started/api-keys
- Adfin - Changelog: product updates (accurate as of November 2026) https://www.adfin.com/resources/changelog
- National Cyber Security Centre - Protect your code repository (accurate as of November 2026) https://www.ncsc.gov.uk/collection/developers-collection/principles/protect-your-code-repository
- National Cyber Security Centre - Securing HTTP-based APIs: API authentication and authorisation (accurate as of November 2026) https://www.ncsc.gov.uk/collection/securing-http-based-apis/2-api-authentication-and-authorisation
