Authentication
An API key, the one company it belongs to, and the scopes it carries.
Every request carries an API key:
Authorization: Bearer ab_...Nothing else authenticates the API — no browser session, no other header. A bearer token that does not start with
ab_ is refused without being looked up.
A key belongs to one company
A key for the API is bound to exactly one company (legal entity) of your organization. That company is the tenant of every request; no request names one. A product that bills for two companies uses two keys.
The API sees what it created: invoices made in the AlphaCount app do not exist for it, not even by id.
Creating a key
An admin creates the key in AlphaCount: Integrations → Connect AI assistants (MCP) → New access, with Choose individually under permissions and Selected entities only with one company. The key is shown once; AlphaCount stores only its SHA-256 hash. Its creator or an admin can revoke it at the same place, and the list shows when each key was last used.
What the API does — bookings, invoices — names the key's creator as the person who acted.
Scopes
A key carries the scopes of the operations it may call. Give a key only what its program needs: a metering service
that reports usage needs partner:usage:write and nothing else.
The scopes of the API open no tool of the MCP server, and the scopes of the MCP server do not open the API.
What is checked
On every request, in this order:
| Check | Refusal |
|---|---|
an Authorization: Bearer header is there | 401 api_key_missing |
an ab_ key, known, not revoked | 401 api_key_invalid |
| not expired | 401 api_key_expired |
| its creator is active and in an organization | 401 api_key_user_inactive |
| it carries the operation's scope | 403 api_key_scope_missing, with scope |
| its creator is an admin of the organization | 403 api_key_admin_required |
| it is bound to exactly one company | 403 api_key_entity_not_single |
| its creator can still reach that company | 403 api_key_entity_not_accessible |
The checks run on every request: when a person loses access to the company or leaves, every key they created stops working at once.