> ## Documentation Index
> Fetch the complete documentation index at: https://developers.getbreezyapp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use one API key for read-only access to its company.

Send `Authorization: Bearer YOUR_API_KEY` and `Accept: application/json`. Your key grants every published read in its associated company. There are no permission scopes or client-selected company IDs. `GET /company` returns the company, currency, and timezone. A valid key cannot read another company's records; a detail ID outside your company returns the same 404 as a missing record.

## Get and use a key

Breezy issues company API keys. Ask your Breezy contact to issue or replace yours. Use HTTPS and send the key in the `Authorization` header. Keep it in your reporting service’s secret storage or environment; do not put it in URLs, source control, shared prompts, or browser applications you distribute to other users.

```http theme={"theme":{"light":"github-light","dark":"github-dark"}}
GET /v1/company HTTP/1.1
Host: api.getbreezyapp.com
Authorization: Bearer YOUR_API_KEY
Accept: application/json
```

## Access and lifecycle

Every published business endpoint is a GET. A key grants all of these reads for its associated company, including financial data. Team-member roles do not narrow that access. An invalid or expired key, or an inactive or mismatched linked identity, returns 401.

## Try a request

The API reference offers an interactive request panel. Requests go directly from your browser to `api.getbreezyapp.com`; browser cookies are not used for authentication. Documentation and the OpenAPI specification are public and require no key.

Mintlify remembers the entered key in this browser across page reloads and includes it in generated request examples. Use a private browser window on shared devices, and check examples for credentials before copying or sharing them.

To remove a remembered key, clear the bearer-token field, then reload the page and confirm the field is empty.

For automated collection, use a server-side client or a trusted local tool. See [Errors and rate limits](/errors) for retries.