Skip to main content
The API Base URL determines which environment your API requests are sent to.

​
How Base URLs Are Constructed

Base URL + Endpoint Path = Final Request URL See: API Reference pages for all API endpoints.

​
Choosing an Environment

We offer Staging and Production environments. See Environments for Pleo Partners, or the Pleo Customers Quickstart for Pleo Customers.
  • Staging: safe testing, experiments, pre-production validation
  • Production: live data, ready integrations

​
Authentication

Pleo APIs support multiple authentication methods depending on the integration type. All authentication methods work with the External API base URLs shown above.

​
OAuth 2.0 (Bearer Token)

Partner integrations must use OAuth 2.0. API requests must include the following header:
Follow the OAuth 2.0 Setup Workflow Guide (Manual Token Lifecycle) to generate an access token.

​
Integrated API Keys

Upon approval from Pleo, some partner integrations may be permitted to use Integrated API Keys.

​
Standalone API Keys

Standalone API Keys aren’t enabled by default and are only supported by Pleo’s NEW External APIs. If enabled for your account, follow the Standalone API Key Workflow Guide to create a key and make your first API request. Authentication uses Basic HTTP authentication:
  • API key as the username
  • Empty password
  • Credentials are automatically Base64 encoded

​
Rate Limits

All Pleo APIs have a rate limit of 600 requests per minute unless stated otherwise in the API Reference. This is a single shared limit per credential (the OAuth token or API key used to authenticate for a company), not per endpoint and not per HTTP method. All calls made with the same credential, across all endpoints and methods (for example, GET and POST), count together toward the same 600 requests/minute bucket. If a workflow uses multiple endpoints under one credential (for example, Vendor Sync’s scheduled and ad hoc runs, Vendor Creation’s draft-vendor polling, and vendor activation), budget their combined request volume against this one shared limit. Exceeding it returns an HTTP 429.

​
Backpressure and Throttling

When a request returns 429:
  • Honor Retry-After if present. Wait at least that long before retrying the same request; if it is absent, back off exponentially starting from a small delay (for example, 1 second, doubling up to a capped maximum).
  • Distinguish item-level retries from run-level throttling. A single 429 on one request in a batch (for example, one Vendor create call during a Vendor Sync write phase) means retry that item; it does not mean abort the whole run. If 429s are sustained across many consecutive requests, treat it as run-level backpressure: pause issuing further requests for that run, and resume the remaining items (or defer them entirely to the next scheduled cycle) once the credential’s request budget has recovered.
  • Never respond to a 429 by re-running a step that has side effects you cannot safely repeat. For Vendor Creation specifically, a 429 on the :activate call is an unknown/failed outcome, not a signal to re-run AS creation (Step 1): follow the pending-activation retry guidance and retry only activation, using the already-persisted AS identifiers.

​
What Comes Next?

​
Review Integration Requirements

​
Setup Authentication

​
FAQs

What is the difference between legacy APIs and new APIs?

Legacy APIs (OpenAPI)
  • Base URL: https://openapi.pleo.io
  • Authentication: API tokens (legacy tokens)
  • Availability: Intended for existing/legacy use cases. Access can depend on your account setup and entitlements.
  • Lifecycle: Deprecated. See the deprecation timeline and migration plan.
New APIs (External API)
  • Base URL: https://external.pleo.io
  • Authentication: API keys (and other authentication methods supported by the platform, including OAuth 2.0, depending on the use case)
  • Availability: Available without restriction, but may need to be enabled for your organisation.
  • What to expect: Newer platform surface and improved structure, but not guaranteed feature parity with legacy APIs yet.
Important:
  • Legacy API tokens will not work on external.pleo.io
  • New API keys will not work on openapi.pleo.io