Pennylane offers a firm API for the need of accounting firms and softwares that work with accounting firms.

Here is the API Reference.

Generating a Firm API token

Pennylane’s Firm API uses bearer tokens to authenticate requests. You can view and manage your token in the Pennylane firm dashboard.

About Firm tokens

A token can only be linked to one firm. But a firm can be associated to several tokens and each token can grant access to different API scopes.

As a consequence, you’ll need to create several tokens if:

• You want to grant different levels of access to different users for the same firm. You’ll then need to create a new token every time you want to grand access to a new combination of scopes.
• You’re using the Firm API with several firms of yours. You’ll then need to create one token per firm, at least.

Generate your Firm token

To generate your Firm API token:

1. Log into your Pennylane firm account.
2. Navigate to Firm settings > Firm Tokens.
3. Click Generate an API Token.
4. Give the token a name and select the scopes you want the token to give access to as well as its expiration date.
5. Click Generate token.
6. Copy your token and save it somewhere safe. For security purposes, tokens aren’t stored on your Pennylane workspace, so this is your only chance to copy yours.
7. Check the box confirming that you have saved your Firm API token elsewhere and click Continue.

From there, you can either:

• Generate another token for the same firm.
• See existing tokens: name, scopes, creation date and creator.
• Delete existing tokens.

Using your Firm token with the Company API v2

A Firm token can also call the Company API v2 on behalf of any company managed by your firm.
Because a Firm token isn't tied to a single company, you must specify which company each request targets. To do so, send the company ID in the X-Company-Id header.

Example request

curl -X GET "https://app.pennylane.com/api/external/v2/ledger_accounts" \
  -H "Authorization: Bearer YOUR_FIRM_TOKEN" \
  -H "X-Company-Id: 12345" \
  -H "Content-Type: application/json"

Scopes

The scopes you selected when generating the token apply as usual:

• Read endpoints (GET): require resource:readonly or resource:all.
• Write endpoints (POST, PUT, PATCH, DELETE): require resource:all.

Errors