> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pleo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Standalone API Key Workflow Guide

export const NoteCallout = ({title, children}) => <div className="callout-box callout-note">
    <div className="callout-row">
      <span className="callout-icon">
        <svg width="22" height="22" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M208,104a79.86,79.86,0,0,1-30.59,62.92A24.29,24.29,0,0,0,168,186v6a8,8,0,0,1-8,8H96a8,8,0,0,1-8-8v-6a24.11,24.11,0,0,0-9.3-19A79.87,79.87,0,0,1,48,104.45C47.76,61.09,82.72,25,126.07,24A80,80,0,0,1,208,104Z" opacity="0.2" /><path d="M176,232a8,8,0,0,1-8,8H88a8,8,0,0,1,0-16h80A8,8,0,0,1,176,232Zm40-128a87.55,87.55,0,0,1-33.64,69.21A16.24,16.24,0,0,0,176,186v6a16,16,0,0,1-16,16H96a16,16,0,0,1-16-16v-6a16,16,0,0,0-6.23-12.66A87.59,87.59,0,0,1,40,104.49C39.74,56.83,78.26,17.14,125.88,16A88,88,0,0,1,216,104Zm-16,0a72,72,0,0,0-73.74-72c-39,.92-70.47,33.39-70.26,72.39a71.65,71.65,0,0,0,27.64,56.3A32,32,0,0,1,96,186v6h64v-6a32.15,32.15,0,0,1,12.47-25.35A71.65,71.65,0,0,0,200,104Zm-16.11-9.34a57.6,57.6,0,0,0-46.56-46.55,8,8,0,0,0-2.66,15.78c16.57,2.79,30.63,16.85,33.44,33.45A8,8,0,0,0,176,104a9,9,0,0,0,1.35-.11A8,8,0,0,0,183.89,94.66Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

export const WarningCallout = ({title, children}) => <div className="callout-box callout-warning">
    <div className="callout-row">
      <span className="callout-badge">
        <svg width="18" height="18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M215.46,216H40.54C27.92,216,20,202.79,26.13,192.09L113.59,40.22c6.3-11,22.52-11,28.82,0l87.46,151.87C236,202.79,228.08,216,215.46,216Z" opacity="0.2" /><path d="M236.8,188.09,149.35,36.22h0a24.76,24.76,0,0,0-42.7,0L19.2,188.09a23.51,23.51,0,0,0,0,23.72A24.35,24.35,0,0,0,40.55,224h174.9a24.35,24.35,0,0,0,21.33-12.19A23.51,23.51,0,0,0,236.8,188.09ZM222.93,203.8a8.5,8.5,0,0,1-7.48,4.2H40.55a8.5,8.5,0,0,1-7.48-4.2,7.59,7.59,0,0,1,0-7.72L120.52,44.21a8.75,8.75,0,0,1,15,0l87.45,151.87A7.59,7.59,0,0,1,222.93,203.8ZM120,144V104a8,8,0,0,1,16,0v40a8,8,0,0,1-16,0Zm20,36a12,12,0,1,1-12-12A12,12,0,0,1,140,180Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

export const RememberCallout = ({title, children}) => <div className="callout-box callout-remember">
    <div className="callout-row">
      <span className="callout-icon">
        <svg width="22" height="22" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M229.66,98.34,172.39,155.8c11.46,22.93-1.72,45.86-10.11,57a8,8,0,0,1-12,.83L42.34,105.76A8,8,0,0,1,43,93.85c29.65-23.92,57.4-10,57.4-10l57.27-57.46a8,8,0,0,1,11.31,0L229.66,87A8,8,0,0,1,229.66,98.34Z" opacity="0.2" /><path d="M235.32,81.37,174.63,20.69a16,16,0,0,0-22.63,0L98.37,74.49c-10.66-3.34-35-7.37-60.4,13.14a16,16,0,0,0-1.29,23.78L85,159.71,42.34,202.34a8,8,0,0,0,11.32,11.32L96.29,171l48.29,48.29A16,16,0,0,0,155.9,224c.38,0,.75,0,1.13,0a15.93,15.93,0,0,0,11.64-6.33c19.64-26.1,17.75-47.32,13.19-60L235.33,104A16,16,0,0,0,235.32,81.37ZM224,92.69h0l-57.27,57.46a8,8,0,0,0-1.49,9.22c9.46,18.93-1.8,38.59-9.34,48.62L48,100.08c12.08-9.74,23.64-12.31,32.48-12.31A40.13,40.13,0,0,1,96.81,91a8,8,0,0,0,9.25-1.51L163.32,32,224,92.68Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

<WarningCallout title="Availability Notice">
  Standalone API Keys are [**not available to all customers**](/docs/current/authentication/standalone-api-keys-overview).
</WarningCallout>

This guide walks through the **end-to-end workflow** for using Standalone API Keys with Pleo APIs. You'll be using **cURL** to make the API calls.

If you prefer to test with Postman:

* Follow Step 1 of this guide to create your Standalone API Key, then
* Follow the [How to Make an API Call Using a Standalone API Key (Postman)](/docs/current/how-tos/api-keys/how-to-make-an-api-call-using-standalone-api-keys-postman) article to configure Postman and make your first API call.

## Before You Start

You must have:

* [Access to the **Pleo Web App**](/docs/current/how-tos/environment-access/how-to-get-access-to-all-env-standalone-api-keys) in **Staging** or **Production**
* **Admin** or **Bookkeeper** permissions

If you do not see **API Keys** under Settings, Standalone API Keys are not enabled for your organisation.

## What You’ll Have Built

By the end of this workflow:

* You have generated a Standalone API Key
* You understand environment and permission scoping
* You have successfully authenticated against the Pleo API

## Workflow Steps

### 1. Generate Your Standalone API Key

**Purpose:** Create an API Key in the Pleo Web App for your chosen environment.

**Input:** No inputs. See [Before You Start](#before-you-start) section.

**Output:** A scoped **API Key** usable for authenticating API requests.

**Integration Design / Why It Matters:**

* Standalone API Keys authenticate API requests and are [scoped by environment, company, and permitted API scopes](/docs/current/authentication/standalone-api-keys-overview#permission-scoped-access).
* Always store API Keys [securely](/docs/current/integration-design/auth/api-keys/integration-design-security-for-standalone-api-keys) after creation. Never expose them publicly or embed them in client-side code.

<NoteCallout title="Integration Note">
  If you plan to build a production integration, review the [Integration Design for Standalone API Keys](/docs/current/integration-design/auth/api-keys/integration-design-for-standalone-api-keys) page to ensure correct lifecycle and security handling.
</NoteCallout>

<section className="mt-4">
  <a
    href="/docs/current/how-tos/api-keys/how-to-generate-standalone-api-keys"
    className="group flex items-center justify-between rounded-md border border-gray-200 dark:border-gray-700 px-4 py-3
bg-gray-50 dark:bg-[#1f262b] hover:bg-[#ffe6ea] dark:hover:bg-[#2b1f23]
transition-colors"
  >
    <div>
      <p className="text-sm font-medium text-gray-900 dark:text-white">
        How to Generate an API Key
      </p>

      <p className="text-xs text-gray-600 dark:text-gray-400">
        Generate a Standalone API Key from the Pleo Web App.
      </p>
    </div>

    <span className="ml-4 text-gray-400">→</span>
  </a>
</section>

***

### 2. Authenticate Your First API Request

**Purpose:** Confirm API connectivity using your Standalone API Key.

**Input:**

* API Key (authentication header)
* `company_id` associated with your Pleo company

<RememberCallout title="Remember">
  Every request must include the correct **company\_id** to ensure proper scoping.
</RememberCallout>

**Output:** A successful API response confirms your key is valid and your requests are correctly scoped.

<section className="mt-4">
  <a
    href="/docs/current/how-tos/api-keys/how-to-make-an-api-call-using-standalone-api-keys"
    className="group flex items-center justify-between rounded-md border border-gray-200 dark:border-gray-700 px-4 py-3
bg-gray-50 dark:bg-[#1f262b] hover:bg-[#ffe6ea] dark:hover:bg-[#2b1f23]
transition-colors"
  >
    <div>
      <p className="text-sm font-medium text-gray-900 dark:text-white">
        Make an API Call Using an API Key
      </p>

      <p className="text-xs text-gray-600 dark:text-gray-400">
        Authenticate your first request.
      </p>
    </div>

    <span className="ml-4 text-gray-400">→</span>
  </a>
</section>

***

## Result

After completing this guide:

* You have a valid Standalone API Key
* You have confirmed API connectivity
* You have a working authenticated setup

***

## What Comes Next?

* Test additional Pleo API endpoints using Standalone API Keys
* Move to OAuth 2.0 if building multi-customer integrations:
  * [OAuth 2.0 Setup with Postman Workflow Guide](/docs/current/guides/oauth-workflow-guide-postman)
  * [OAuth 2.0 Setup Workflow Guide (Manual Token Lifecycle)](/docs/current/guides/oauth-workflow-guide)

***

## Related Reading

* [Integration Design for Standalone API Keys](/docs/current/integration-design/auth/api-keys/integration-design-for-standalone-api-keys)
* [User Experience Guidelines for Standalone API Keys](/docs/current/integration-design/auth/api-keys/integration-design-user-exp-guidelines-for-standalone-api-keys)
* [Security and Credential Management for Standalone API Keys](/docs/current/integration-design/auth/api-keys/integration-design-security-for-standalone-api-keys)

***