Skip to main content
This section explains how integrations establish and maintain a secure connection between Pleo and an external system. Connection and authorisation ensure that:
  • requests are authenticated securely
  • permissions are correctly applied
  • data is exchanged with the correct company
  • integrations operate reliably over time
Pleo supports multiple authentication models designed for different integration scenarios.

​
Authentication Policy Overview

All authentication methods are technically supported in both Staging and Production environments. The primary difference between methods is who may use them and under what conditions.
If your integration…Use
Connects multiple customers and supports user consent flowsOAuth 2.0 (Required for Partners)
Is an approved accounting or ERP integration that cannot support OAuth 2.0 redirectsIntegrated API Keys (Approved Exception)
Requires controlled API access for testing or internal toolingStandalone API Keys (Limited Availability)

​
High-level Comparison

Below is a high-level overview of the characteristics of each authentication method.
AspectOAuth 2.0Integrated API KeysStandalone API Keys
Recommended for production integrations✅ Yes⚠️ Approved exceptions⚠️ Limited
Multi-customer integrations✅ Yes✅ Yes (one key per installation)⚠️ Limited
How access is grantedRedirect and user consentInstallation approval in PleoManual key creation
Credential typeAccess token + refresh tokenInstallation-scoped API keyManually created API key
Credential lifecycleAutomatic token refreshManual rotation if replacedManual rotation
Typical usageMost marketplace integrationsAccounting/ERP systems without OAuth 2.0 supportInternal tooling and API testing

​
Credential Handling Principles

While implementation details vary by authentication method, the following principles apply to all integrations:
  • Credentials, including access tokens, refresh tokens, and API keys, must be treated as sensitive secrets.
  • Integrations must implement responsible credential management.
  • Integrations should maintain long-lived operation without repeated manual intervention.
  • Authentication failures must be detected and handled gracefully.
Each integration represents a one-to-one connection between:
  • a Pleo company, and
  • a corresponding company or tenant in the external system.
Correct entity association ensures data is synchronised with the appropriate accounts, as defined by the Multi-Entity model.
OAuth 2.0 API Keys