Skip to main content
Every request carries a bearer token:

​
Keys

Keys are personal. Each key belongs to the member who created it — it is never shared across the team, and only its owner ever sees the token. The full token appears exactly once, at creation. Cherry stores only a hash — a lost token can’t be recovered, only revoked and replaced. Each key is scoped to one business. Everything you read or write through it is scoped to that business, attributed to the key’s owner; there is no cross-business access. Who can create keys: owners and admins always can. Other roles need API access enabled by an admin in Settings. Read-only roles (viewer, CPA viewer) can create read keys only.

​
Scopes

A request with an insufficient scope returns 403 with {"error": "forbidden", "reason": "key lacks required scope"}.

​
Failures

​
Revocation

Revoking a key takes effect immediately. You can revoke your own keys; owners and admins can revoke any key in the business. Revoked keys stay visible in the key list as an audit trail.