> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://api-docs.papertracc.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://api-docs.papertracc.com/_mcp/server.

# Overview

The Papertracc API lets you work with a workspace from your own software. It has two parts:

| Part                      | What it is for                                                                                                                                                         |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Core](/core)             | Accounting and records: chart of accounts, customers and vendors, tax and payment terms, inventory, invoices, receipts, bills, expenses, payments and manual journals. |
| [Storefront](/storefront) | Building your own shop: catalogue, blog, newsletter signup, cart and checkout for one sales channel.                                                                   |

## Base URL

| Environment       | URL                               |
| ----------------- | --------------------------------- |
| Production        | `https://api.papertracc.com/v1`   |
| Release candidate | `https://api.papertracc.com/rc-1` |

## Authentication

Every request needs two headers:

| Header          | Value                                          |
| --------------- | ---------------------------------------------- |
| `Authorization` | `Bearer` followed by your API key.             |
| `identity`      | The identity of the workspace you are calling. |

Get both from the Papertracc dashboard. Storefront requests also send the sales channel in a `channel` header; see the [Storefront overview](/storefront).

```bash
curl "https://api.papertracc.com/v1/accounts" \
  -H "Authorization: Bearer $API_KEY" \
  -H "identity: $WORKSPACE_IDENTITY"
```

## Keys

A workspace has two kinds of key. Both go in the `Authorization` header in the same way.

| Key                | Where to use it                                                     | How it is checked                                                                                     |
| ------------------ | ------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| Public key (`pk_`) | In a browser or mobile app. It is safe to ship in your site's code. | Works only on the endpoints listed below. It skips the role check.                                    |
| Secret key (`sk_`) | On your server only. Never send it to a browser.                    | Works on every endpoint. On Core endpoints it runs with the role of the team member who generated it. |

### Which key works where

| Endpoints                                              | Public key | Secret key |
| ------------------------------------------------------ | ---------- | ---------- |
| Storefront: every endpoint                             | Yes        | Yes        |
| Core: List Accounts, Get Chart Types, Get Tax Profiles | Yes        | Yes        |
| Core: every other endpoint                             | No         | Yes        |

Every endpoint page ends with a **Keys** line that says which keys it accepts. A public key sent to an endpoint that does not accept it is rejected with `401`.

* A test key only works with a test workspace, and a live key only with a live workspace.
* The member who generated the keys must belong to the workspace you call. Keys stop working when that member is removed from the organisation.
* The workspace's subscription plan must include the Open API. If it does not, requests fail with `402` and `error_code: OPEN_API_NOT_ENABLED`.

## Responses

Successful responses share one envelope. `data` holds the record or list you asked for, and is left out when there is nothing to return.

```json
{
  "status": true,
  "message": "Successfully fetched shop",
  "data": {}
}
```

Failed requests return `status: false` with a `message`. See [Errors](/errors) for the status codes and [Pagination](/pagination) for how lists are paged.