Skip to main content
This section explains how integrations establish and maintain a secure connection between Pleo and an external system. Connection and authorisation ensure that:
  • requests are authenticated securely
  • permissions are correctly applied
  • data is exchanged with the correct company
  • integrations operate reliably over time
Pleo supports multiple authentication models designed for different integration scenarios.

​
Authentication Policy Overview

All authentication methods are technically supported in both Staging and Production environments. The primary difference between methods is who may use them and under what conditions.

​
High-level Comparison

Below is a high-level overview of the characteristics of each authentication method.

​
Credential Handling Principles

While implementation details vary by authentication method, the following principles apply to all integrations:
  • Credentials, including access tokens, refresh tokens, and API keys, must be treated as sensitive secrets.
  • Integrations must implement responsible credential management.
  • Integrations should maintain long-lived operation without repeated manual intervention.
  • Authentication failures must be detected and handled gracefully.
Each integration represents a one-to-one connection between:
  • a Pleo company, and
  • a corresponding company or tenant in the external system.
Correct entity association ensures data is synchronised with the appropriate accounts, as defined by the Multi-Entity model.
OAuth 2.0 API Keys