API keys

Authentication is a single bearer token.

curl https://api.facturia.cl/v1/documents \
  -H "Authorization: Bearer sk_live_9lQpV3fA2mKcRt7wZxYb1Nde"

Keys are account-scoped, shown once, stored hashed, and revoked one at a time. Create them in the dashboard or through the API.

A key carries three things:

• a mode (test / live) — immutable, encoded in the prefix;
• a set of scopes — see Scopes;
• an empresa allowlist — ["*"] (every empresa in the account, including ones created later) or an explicit list of RUT, Chile's taxpayer id numbers.

Who am I

curl https://api.facturia.cl/v1/account \
  -H "Authorization: Bearer $FACTURIA_KEY"

{
  "object": "account",
  "id": "acct_01K2QW8V6ZR3T5NM",
  "name": "Connect Core",
  "key": {
    "id": "key_01K2QWA3F2",
    "name": "production-backend",
    "mode": "live",
    "last4": "1Nde",
    "scopes": ["documents:read", "documents:write", "tax:read"],
    "empresas": ["77928532-4", "78281439-7"],
    "created_at": "2026-08-01T17:22:04Z",
    "last_used_at": "2026-08-14T13:04:10Z"
  },
  "limits": { "requests_per_minute": 300, "emissions_per_second": 10 }
}

This is the cheap call for a health check: it tells you which key you are using, with which scopes, over which empresas, and under which limits.

Empresa token

A key whose allowlist holds exactly one empresa is an empresa token: the Facturia-Empresa header becomes optional, and if you do send it, it has to match or you get 400 empresa_mismatch.

This is the recommended shape when you integrate a single company, or when you hand a key to a customer's system: the key cannot address anything but that RUT.

Email verification

Signing up does not require proving your address, and neither does logging in, reading anything, or using the whole product in test mode. Verification blocks exactly one thing: creating a live credential.

# Confirmar — el token viene del enlace del correo. No necesita sesión:
# quien hace clic tiene un enlace, posiblemente en otro dispositivo.
curl -sS https://api.facturia.cl/account/verify \
  -H "Content-Type: application/json" -d '{"token":"..."}'

# Reenviar — este sí necesita la sesión, para que no nos puedan usar para mandarle correo a nadie.
curl -sS -X POST https://api.facturia.cl/account/verification/resend \
  -H "Authorization: Bearer $TOKEN"

The link is single-use, lives 24 hours, and is bound to the address it was sent to: if the account's email changes in the meantime, the token is rejected rather than confirming an address it was never delivered to. Clicking twice is a success, not an error. Resends are rate limited and answer 429 with Retry-After.

Minting an sk_live_ key from an unverified account returns 403 email_verification_required.