Get access and API keys

The Business Account API is in beta: access is granted per business, and a team administrator creates API keys in the Business Account dashboard.

​

Request access

• Who can request: a team administrator of a business whose card application is Issued. If you’re not an admin, ask one to request access.
• How: in the dashboard, go to API › Request access and describe your use case in 30 to 1,000 characters. The page then shows Access requested and your Reap account manager follows up. No email is sent when access is granted.

​

Create an API key

Once access is enabled, an admin creates keys in the dashboard under API. Each key has:

• A nickname so your team can tell keys apart.
• At least one scope. Scopes limit which endpoints the key can call. See the scope table. Each use case page lists the scopes it needs.
• An IP allowlist, on by default. Enter single IPs or ranges; calls from anywhere else get 403 API_KEY_IP_NOT_ALLOWED. Turning the allowlist off needs a deliberate confirmation, so keep it on unless you can’t fix your egress IPs.

The key secret is shown once at creation. If you lose it, revoke the key and create a new one.

​

Limits and lifecycle

• Up to 10 active keys per business.
• Any admin sees and manages every key; there are no personal keys.
• A key can be renamed, have its scopes edited, or be revoked at any time. Revoking is immediate.
• New scopes are never added to existing keys automatically. When the API gains scopes (the Treasury scopes, for example) an admin edits the key to add them.
• Bank transfer confirmations are recorded under the person who created the key. If they leave the team, create a new key under a current member or calls fail with 403 TREASURY_REQUESTER_NOT_AVAILABLE.

​

Showing card details in your own app

A card number, expiry and CVV count as cardholder data: any system that stores or transmits them falls inside PCI DSS scope. The Reveal card endpoint keeps yours out of it: it returns a short-lived accessUrl to a Reap-hosted window that shows the card details, so card data travels from Reap to the user’s screen without touching your servers. Do:

• Call reveal from your backend, only when a user who is allowed to see the card asks for it.
• Load the accessUrl directly in one iframe, and request a fresh URL each time the view opens; it expires after 1 minute.

Don’t:

• Let your API key reach a user’s device. cards:read_vault covers every card in the business.
• Log, store, parse or modify the accessUrl, or send it to analytics, error-reporting or session-replay tools.

If the iframe renders blank on your domain, ask Reap to enable embedding for your origin, or open the URL directly in a new tab. See Card details for the full rules.

​

Next steps