API keys and webhooks

API keys

• Create keys in Settings › Integrations › API keys.
• Live keys start with fnerp_live_ and test keys with fnerp_test_.
• Each key has scopes that limit what it can do. Test keys can only read.
• Rotate or revoke a key at any time.
• A key is shown once, when you create it. Store it somewhere safe.

Webhooks

Webhooks tell your system the moment something happens in AXO.

1. Add an endpoint address and choose the events.
2. Verify it. AXO sends a challenge your endpoint must answer — or, for tools such as Zapier, you confirm it yourself.
3. Once it's verified, AXO sends events as they happen.

• Every delivery is signed with HMAC in the X-FinanceErp-Signature header. Check the signature before trusting what you receive.
• Failed deliveries are retried. An endpoint that keeps failing is switched off automatically, and you're alerted.
• Endpoints that haven't been verified receive nothing.