The public API lets a business read and write its own customers, invoices, payments, and balances. It is part of the Enterprise plan. Create a key in Settings, then Developers. The full key is shown once. RecoverPe stores only a SHA-256 hash and a short prefix.
Authentication
Send Authorization: Bearer rp_live_.... Each key has the same permissions as a teammate: manage team, edit settings, edit invoices and payments, send reminders, export data, and spend funds. A revoked key is rejected. A key can only reach the business it was created for.
Routes
- GET and POST /api/v1/customers
- GET and POST /api/v1/invoices
- GET /api/v1/invoices/{id}
- POST /api/v1/payments
- GET /api/v1/balances
Reading needs the export permission. Creating a customer, invoice, or payment needs the edit invoices and payments permission. Send Idempotency-Key when creating an invoice so a retry returns the same invoice.
The machine-readable description is at /api/v1/openapi.json.
Webhooks
Add an https address in Developers. RecoverPe posts JSON for invoice.created, payment.received, invoice.overdue, and promise.missed. The header RecoverPe-Signature looks like t=1710000000,v1=.... v1 is HMAC-SHA256 of the timestamp, a dot, and the raw body, using the signing secret shown once when the webhook is created. Private addresses are refused. A failed delivery is retried with a longer wait, then marked failed.
Company sign-in
On the sign-in page, choose Sign in with company SSO and enter a work email. Google Workspace and Microsoft use Firebase. The domain must have a verified DNS TXT record before someone can join. The owner picks the role they receive.