# API access

## API keys

**API keys** (`/api-keys`) creates personal tokens to automate your account through the PeltyCMS API, for example to list invoices or order services from your own scripts.

- Give the key a name, choose what it may do (scopes) and optionally an expiry (1 to 3650 days).
- The key is shown **once**. Store it like a password.
- Send it as a header: `Authorization: Bearer pelty_…`.
- A key cannot sign in, change your password or manage other keys.
- Revoke a key at any time; the list shows when and from which IP address each key was last used.

```bash
curl -H "Authorization: Bearer $PELTY_KEY" https://billing.example.com/api/v1/client/invoices
```

## Headless ordering

The headless API lets your own shop or app sell your provider's products with an API key: read the catalog, build a cart, check out, pay the invoice and follow the order.

| Method | Path | Summary |
|---|---|---|
| POST | `/api/v1/headless/carts` | Create a server-side cart owned by the key's customer; the response holds |
| GET | `/api/v1/headless/carts/{id}` |  |
| PUT | `/api/v1/headless/carts/{id}` |  |
| POST | `/api/v1/headless/carts/{id}/checkout` | Turn the cart into an order and a finalized invoice (fraud screening, |
| GET | `/api/v1/headless/catalog` | Catalog, enabled currencies and payment gateways in one call. |
| POST | `/api/v1/headless/invoices/{id}/pay` | Start a payment for an invoice; returns the gateway redirect/action. |
| GET | `/api/v1/headless/orders/{id}` | Order status with its invoice and provisioned services. |

Full request and response details: [HTTP API](developers/api.md).

## Connected apps

**Connected apps** (`/connected-apps`) lists apps you allowed to sign in with your account. Revoke access to any you no longer use.

The full API reference is in the [developer docs](developers/api.md).