Divvy Authentication

generated: '2026-07-18'
method: searched
source: >-
  https://developer.bill.com/docs/bill-keys-tokens and
  https://developer.bill.com/docs/authentication-with-api-token — Divvy is now
  BILL Spend & Expense; its API is delivered through the BILL developer platform.
docs: https://developer.bill.com/docs/bill-keys-tokens
description: >-
  BILL uses a session/token model, not OAuth. The BILL AP/AR/network APIs use a
  developer key (devKey) plus a session token (sessionId) obtained from
  POST /v3/login; both are sent as headers on every subsequent call. The BILL
  Spend & Expense (formerly Divvy) API uses a separate Spend & Expense API
  token, sent as the apiToken header, with no API login step.
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
  oauth2: false
schemes:
  - name: SpendExpenseApiToken
    type: apiKey
    in: header
    parameter: apiToken
    applies_to: BILL Spend & Expense (Divvy) API endpoints
    docs: https://developer.bill.com/docs/authentication-with-api-token
    note: Generated in the BILL Spend & Expense product; no /v3/login required.
  - name: DevKeyAndSession
    type: apiKey
    in: header
    parameters: [devKey, sessionId]
    applies_to: BILL AP, AR, BILL network, and webhook APIs
    docs: https://developer.bill.com/docs/bill-keys-tokens
    detail: >-
      sessionId is created via POST /v3/login (username, password, organizationId,
      devKey). Standard sessions expire after 35 minutes of inactivity; AP/AR sync
      token sessions last 48 hours. MFA-trusted sessions are supported via
      rememberMeId + device.
  - name: PartnerAppKey
    type: apiKey
    in: header
    parameters: [appKey, sessionId]
    applies_to: Partner-level operations (POST /v3/partner/login)
    docs: https://developer.bill.com/reference/partnerlogin
notes:
  - No OAuth 2.0 or scopes are documented; scopes/ artifact intentionally omitted.
  - MFA is supported for BILL v3 API sessions (rememberMeId + device).