> ## Documentation Index
> Fetch the complete documentation index at: https://direct-api.reap.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Get access and API keys

> Who can request Business Account API access, how API keys are created, and the rules for scopes, IP allowlists and key lifecycle.

The Business Account API is in beta: access is granted per business,
and a team administrator creates API keys in the Business Account dashboard.

## Request access

> [!WARNING]
>
> The Business Account API is in beta. When you request access, the Reap team
> reviews your application and contacts you.

* **Who can request:** a team administrator of a business whose card
  application is [Issued](https://support.reap.global/hc/en-us/articles/16006225821199-How-do-I-check-my-Reap-application-status). If you're not an admin, ask one to request access.
* **How:** in the dashboard, go to **API** › **Request access** and describe
  your use case in 30 to 1,000 characters. The page then shows **Access
  requested** and your Reap account manager follows up. No email is sent when
  access is granted.

## Create an API key

Once access is enabled, an admin creates keys in the dashboard under **API**.
Each key has:

* **A nickname** so your team can tell keys apart.
* **At least one scope.** Scopes limit which endpoints the key can call. See
  the [scope table](/api-reference/authentication.md#scopes). Each use case page
  lists the scopes it needs.
* **An IP allowlist**, on by default. Enter single IPs or ranges; calls from
  anywhere else get `403 API_KEY_IP_NOT_ALLOWED`. Turning the allowlist off
  needs a deliberate confirmation, so keep it on unless you can't fix your
  egress IPs.

The key secret is shown **once** at creation. If you lose it, revoke the key
and create a new one.

> [!WARNING]
>
> Treat API keys like passwords. Store them in a secrets manager, never in
> source control or the browser, and revoke a key immediately if it's exposed.

## Limits and lifecycle

* Up to **10 active keys** per business.
* Any admin sees and manages every key; there are no personal keys.
* A key can be renamed, have its scopes edited, or be revoked at any time.
  Revoking is immediate.
* **New scopes are never added to existing keys automatically.** When the API
  gains scopes (the Treasury scopes, for example) an admin edits the key to
  add them.
* Bank transfer confirmations are recorded under the person who created the
  key. If they leave the team, create a new key under a current member or
  calls fail with `403 TREASURY_REQUESTER_NOT_AVAILABLE`.

## Showing card details in your own app

A card number, expiry and CVV count as cardholder data: any system that
stores or transmits them falls inside PCI DSS scope. The
[Reveal card](/api-reference/cards/reveal-card-details.md) endpoint keeps yours
out of it: it returns a short-lived `accessUrl` to a Reap-hosted window that
shows the card details, so card data travels from Reap to the user's screen
without touching your servers.

**Do:**

* Call reveal from your backend, only when a user who is allowed to see the
  card asks for it.
* Load the `accessUrl` directly in one iframe, and request a fresh URL each
  time the view opens; it expires after 1 minute.

**Don't:**

* Let your API key reach a user's device. `cards:read_vault` covers every
  card in the business.
* Log, store, parse or modify the `accessUrl`, or send it to analytics,
  error-reporting or session-replay tools.

If the iframe renders blank on your domain, ask Reap to enable embedding for
your origin, or open the URL directly in a new tab.

See [Card details](/concepts/card-details.md) for the full rules.

## Next steps

<table><thead><tr><th>Done in the dashboard</th>
<th>What the API does instead</th>
<th>Help Center article</th></tr></thead>
<tbody><tr><td>Request API access, create, edit and revoke API keys, IP allowlist</td>
<td>Nothing; keys are managed by admins only</td>
<td>Article coming soon</td></tr>
<tr><td>Invite, edit and remove team members and team groups</td>
<td>Reads them with `GET /team-members`</td>
<td>Managing Your Team</td></tr>
<tr><td>Set up approval workflows and approve or reject card requests</td>
<td>Returns `202 pendingApproval`; poll `GET /cards?title=`</td>
<td>How do I set up approval workflows for my team?</td></tr>
<tr><td>Add funds and withdraw collateral</td>
<td>Gives the funding information and lists Treasury history</td>
<td>How to add funds to your Reap Account</td></tr>
<tr><td>Order and activate physical cards</td>
<td>Reads physical cards; creates virtual cards only</td>
<td>How do I issue a Virtual or Physical card to a Team Member?</td></tr>
<tr><td>Correct transaction categories and attach receipts</td>
<td>Reads categories and the `hasReceipt` flag</td>
<td>Reviewing and Categorizing Transactions</td></tr>
<tr><td>Repay the card balance, statements, credit limit changes</td>
<td>Reads balances and activities</td>
<td>How do I repay my Card balance?</td></tr>
<tr><td>Company, entity and account settings, 2FA, login</td>
<td>Nothing</td>
<td>How do I update my account information?</td></tr></tbody></table>

> **[Quickstart](/quickstart.md)**
>
> From a new key to your first card in a few calls.

> **[Authentication](/api-reference/authentication.md)**
>
> How to send the key and the full scope table.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.