Skip to main content
The Beenos Solutions API uses API keys to authenticate every request. You must include a valid API key in the Authorization header of all requests — the API rejects any request that is missing a key or presents an invalid one with a 401 Unauthorized response. API keys are tied to your workspace and inherit the permission scope you assign at creation time.
Never commit API keys to source control. Store them in environment variables or a secrets manager such as AWS Secrets Manager, HashiCorp Vault, or your CI/CD platform’s secret store. Rotating an exposed key immediately limits damage — see Rotating and Revoking Keys below.

​
Creating an API Key

Generate a new API key from the Beenos Solutions dashboard. You can create multiple keys with different scopes — for example, one key for your production server and a separate key for local development.
1

Open the Dashboard

Log in to your Beenos Solutions workspace at app.beenossolutions.com.
2

Navigate to Settings

Click Settings in the left-hand navigation panel.
3

Open the API Keys section

Select the API Keys tab within Settings.
4

Create a new key

Click Create Key, enter a descriptive name (for example, Production Server or Local Dev), and choose the appropriate scope for your use case.
5

Copy your key immediately

Your API key is displayed only once immediately after creation. Copy it to a secure location right away — you cannot retrieve the full key value again after you close this dialog. If you lose the key, revoke it and generate a new one.

​
Using Your API Key

Pass your API key as a Bearer token in the Authorization header of every request. Replace YOUR_API_KEY with the key you copied from the dashboard.
Here is a complete example request using curl:

​
API Key Format

Beenos Solutions API keys use a prefix that identifies the environment the key targets. Always verify you are using the correct key type before making requests. Using a bns_test_ key against the production base URL will return a 403 Forbidden response, and vice versa. Keep your production and sandbox keys strictly separated.

​
Key Scopes

When you create an API key, you assign it one of three permission scopes. Choose the most restrictive scope that satisfies your integration’s requirements.

​
Rotating and Revoking Keys

Rotate your API keys periodically as a security best practice, and revoke them immediately if you suspect a key has been exposed.
1

Create a replacement key

Follow the steps in Creating an API Key to generate a new key with the same scope as the key you are replacing.
2

Update your integration

Deploy the new key value to all services and environments that use the old key before you revoke it.
3

Revoke the old key

In the dashboard, go to Settings → API Keys, find the old key, and click Revoke. Confirm the action in the dialog that appears.
Revoking a key takes effect immediately and cannot be undone. Any in-flight or subsequent requests that use the revoked key will receive a 401 Unauthorized response. Make sure you have fully deployed the replacement key before revoking the old one.