Authentication
The Customer API authenticates with a personal access token, sent in the Authorization header
of every request:
Authorization: Bearer YOUR_TOKEN
A single token, no scopes
Your Customer API token has no scopes to choose — it enables all supported Customer operations, including creating receipts for your account. The portal manages one active token: generating a new one instantly invalidates the previous one (see Getting started).
Why a request might fail with 403
Your token can be rejected for a few different reasons, each with its own message:
| Reason | Message |
|---|---|
| The token isn't valid for this audience | This token is not valid for the customer API. |
| The organization hasn't activated the Customer API on their account yet | The customer API is not enabled for this account. |
| Your individual access isn't enabled | API access has not been enabled for this account. |
| Your account doesn't have the required role | This account does not have the customer role. |
If you see any of these, the problem isn't your token itself — contact your service provider to have them check your account's configuration.
Expiration and revocation
- Your token has no expiration date — it stays valid until you revoke it or generate a new one (which automatically invalidates the previous one).
- You can revoke it at any time from the same API Access tab in the portal — revocation is immediate.
- A revoked token responds with
401 Unauthenticatedon any request.
Multi-tenant: your token belongs to a single organization
Your token is specific to the organization you work with. If you're a customer of more than one organization using Midla Platform, you need a separate token for each one — generated from each one's portal respectively.