Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
openapi: 3.2.0
info:
title: Fawtar Business Sandbox Keys API
x-capabilities: https://fawtar.app/.well-known/fawtar-capabilities.json
version: 1.0.0
description: 'Arabic-first invoicing, accounting, payroll and point of sale for Saudi businesses. Invoice QR fields do not establish full system compliance or Phase 2 integration. Filtering and sorting follow ransack conventions, and the API-KEY header is accepted alongside Authorization: Bearer, so a client written against Qoyod can be repointed here by changing the base URL and the key. Agent capabilities, sandbox onboarding and prepaid prices: https://fawtar.app/.well-known/fawtar-capabilities.json'
contact:
name: Fawtar
url: https://fawtar.app/docs/api
servers:
- url: https://fawtar.app
security:
- bearerAuth: []
tags:
- name: Sandbox Keys
paths:
/api/v1/sandbox-keys:
post:
operationId: createSandboxKey
summary: Try a 24-hour sandbox without signup
security: []
description: No PII or request body. Three keys per trusted IP per day, global cap 100/day. Sandbox invoices require taxTreatment=ordinary and are watermarked. No ZATCA, live tax invoices or outbound webhooks.
responses:
'201':
description: Sandbox org, one-time secret test key, 100 trial write credits and 86400 seconds lifetime
content:
application/json:
schema:
type: object
additionalProperties: true
'429':
description: Issuance cap reached
content:
application/json:
schema:
type: object
additionalProperties: true
'503':
description: Onboarding unavailable
content:
application/json:
schema:
type: object
additionalProperties: true
tags:
- Sandbox Keys
components:
securitySchemes:
supabaseSession:
type: http
scheme: bearer
description: Provider-verified Supabase access token, for onboarding claims only.
bearerAuth:
type: http
scheme: bearer
description: 'Authorization: Bearer fwt_live_… or fwt_test_…'
apiKeyHeader:
type: apiKey
in: header
name: API-KEY
description: Qoyod-compatible header carrying the same key.