Divvy · Authentication Profile

Divvy Authentication

Authentication

BILL uses a session/token model, not OAuth. The BILL AP/AR/network APIs use a developer key (devKey) plus a session token (sessionId) obtained from POST /v3/login; both are sent as headers on every subsequent call. The BILL Spend & Expense (formerly Divvy) API uses a separate Spend & Expense API token, sent as the apiToken header, with no API login step.

Divvy secures its APIs with apiKey across 3 declared security schemes, as derived from its OpenAPI definitions.

CompanyPaymentsSpend ManagementCorporate CardsExpense ManagementFintechBill

Methods: apiKey Schemes: 3 OAuth flows: API key in: header

Security Schemes

SpendExpenseApiToken apiKey

· in: header (apiToken)

DevKeyAndSession apiKey

· in: header ()

PartnerAppKey apiKey

· in: header ()

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: >-
  https://developer.bill.com/docs/bill-keys-tokens and
  https://developer.bill.com/docs/authentication-with-api-token — Divvy is now
  BILL Spend & Expense; its API is delivered through the BILL developer platform.
docs: https://developer.bill.com/docs/bill-keys-tokens
description: >-
  BILL uses a session/token model, not OAuth. The BILL AP/AR/network APIs use a
  developer key (devKey) plus a session token (sessionId) obtained from
  POST /v3/login; both are sent as headers on every subsequent call. The BILL
  Spend & Expense (formerly Divvy) API uses a separate Spend & Expense API
  token, sent as the apiToken header, with no API login step.
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
  oauth2: false
schemes:
  - name: SpendExpenseApiToken
    type: apiKey
    in: header
    parameter: apiToken
    applies_to: BILL Spend & Expense (Divvy) API endpoints
    docs: https://developer.bill.com/docs/authentication-with-api-token
    note: Generated in the BILL Spend & Expense product; no /v3/login required.
  - name: DevKeyAndSession
    type: apiKey
    in: header
    parameters: [devKey, sessionId]
    applies_to: BILL AP, AR, BILL network, and webhook APIs
    docs: https://developer.bill.com/docs/bill-keys-tokens
    detail: >-
      sessionId is created via POST /v3/login (username, password, organizationId,
      devKey). Standard sessions expire after 35 minutes of inactivity; AP/AR sync
      token sessions last 48 hours. MFA-trusted sessions are supported via
      rememberMeId + device.
  - name: PartnerAppKey
    type: apiKey
    in: header
    parameters: [appKey, sessionId]
    applies_to: Partner-level operations (POST /v3/partner/login)
    docs: https://developer.bill.com/reference/partnerlogin
notes:
  - No OAuth 2.0 or scopes are documented; scopes/ artifact intentionally omitted.
  - MFA is supported for BILL v3 API sessions (rememberMeId + device).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/divvy-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.