Skip to main content
Sintropix API keys let agents and integrations authenticate as a User without a browser session. Each key is a long-lived credential passed in the x-api-key header, inherits the owning User’s Role and Memberships, and is rate-limited to 25,000 requests per hour. Keys are created in the Sintropix web app at app.sintropix.com. The whole trip takes under a minute.
1

Sign in and open Settings

Sign in as the User the key should act on behalf of. The key inherits that User’s Role and per-Entity Memberships, so choose a User with the access the integration actually needs.Click your name at the bottom of the left sidebar and choose Ajustes.
Sintropix home screen with the user menu open, showing Ajustes and Cerrar sesión

The user menu at the bottom-left of the app. Ajustes opens Settings.

2

Go to Claves de API

Settings opens on the Empresa page. In the Configuración list on the left, click Claves de API.
Sintropix Settings with the Configuración sidebar, Claves de API highlighted

Claves de API in the Settings sidebar.

The page lists every key you own with its name, prefix, creation date, expiry, and last use. Keys can be revoked from the trash icon on each row.
Claves de API page listing existing keys with a Crear clave button

Existing keys. Only the prefix is shown; the secret is never displayed again after creation.

3

Create the key

Click Crear clave. Give the key a descriptive name (for example erwin-agent or reconciliation-bot) so you can identify it later in the key list and the audit trail, then click Crear clave in the dialog.
Crear clave de API dialog with a Nombre field

Name the key after the software that will use it.

4

Copy the secret

The key is shown once. Copy it with the button next to the field and store it in your secrets manager before clicking Listo. Sintropix does not display the secret again after this screen; if you lose it, revoke the key and create a new one.
Copia tu clave de API dialog showing the secret once, with the x-api-key and x-audit-actor headers

The one-time secret dialog. It also reminds you of the two headers every mutating request needs.

5

Call the API

Send the key in the x-api-key header on every request:
Every mutating request (POST, PUT, PATCH, DELETE) made with a key must also send an x-audit-actor header naming the software that is acting. The value is recorded verbatim in the audit trail; omitting it returns 400.
Requests to /api/auth/* are rejected when they carry x-api-key, so keys cannot be used to mint further keys or manage Users.

​
Scope and Permissions

  • A key authenticates as its owning User with that User’s global Role and per-Entity Memberships.
  • Business routes are scoped by Entity (/api/entities/{entityId}/...). A key can only access Entities the owning User is a member of.

​
Rate Limits

Each key is limited to 25,000 requests per hour on a sliding window. Requests over the limit return 429 Too Many Requests; back off and retry after the window resets.

​
Rotation and Revocation

  • Rotate keys on a schedule and whenever a team member with access leaves.
  • Revoke a key immediately from Ajustes → Claves de API if you suspect it has leaked. Revocation takes effect on the next request.
  • Every action taken with a key is recorded in the audit trail under the owning User, so leaked-key activity is traceable.

API Overview

Base URL, request and response format, error envelope, and per-Entity scoping.