Authentication

The Customer API authenticates with a personal access token, sent in the Authorization header of every request:

Authorization: Bearer YOUR_TOKEN

A single token, no scopes

Your Customer API token has no scopes to choose — it enables all supported Customer operations, including creating receipts for your account. The portal manages one active token: generating a new one instantly invalidates the previous one (see Getting started).

Why a request might fail with 403

Your token can be rejected for a few different reasons, each with its own message:

Reason	Message
The token isn't valid for this audience	This token is not valid for the customer API.
The organization hasn't activated the Customer API on their account yet	The customer API is not enabled for this account.
Your individual access isn't enabled	API access has not been enabled for this account.
Your account doesn't have the required role	This account does not have the customer role.

If you see any of these, the problem isn't your token itself — contact your service provider to have them check your account's configuration.

Expiration and revocation

• Your token has no expiration date — it stays valid until you revoke it or generate a new one (which automatically invalidates the previous one).
• You can revoke it at any time from the same API Access tab in the portal — revocation is immediate.
• A revoked token responds with 401 Unauthenticated on any request.

Multi-tenant: your token belongs to a single organization

Your token is specific to the organization you work with. If you're a customer of more than one organization using Midla Platform, you need a separate token for each one — generated from each one's portal respectively.