Skip to main content
API keys let scripts, services, and third-party tools access your Sure data without going through the web UI. Each key is tied to your user account and carries a permission scope that controls what the caller can do.

​
Creating an API key

  1. Go to Settings → API Keys.
  2. Click New API Key.
  3. Enter a descriptive name — for example, “Budget export script” or “Portfolio tracker”.
  4. Select a permission scope (see Scopes below).
  5. Click Save API Key.
Sure displays the full key value once immediately after creation. Copy it and store it securely. The raw value is not shown again — if you lose it, revoke the key and create a new one.

​
Scopes

Each API key has exactly one permission scope: Choose the narrowest scope that satisfies your use case. A read-only key cannot write data even if an endpoint would normally accept it.

​
Using an API key

Include the key in the X-Api-Key request header:
The API also accepts OAuth2 bearer tokens for registered OAuth clients. See the API reference for endpoint details.

​
Rate limits

Rate limits apply to API key requests. Limits reset at the top of each hour. All keys start on the standard tier. The current tier is shown on the key’s detail page in settings. When a key exceeds its limit, the API returns HTTP 429 Too Many Requests. The response includes:
Every API response includes rate limit headers:
Rate limiting only applies to hosted instances. Self-hosted deployments have no rate limit applied to API key requests.

​
Exporting to Google Sheets

The Reports section lets you fetch an updating transaction breakdown into Google Sheets using the =IMPORTDATA() formula and your API key.
  1. Go to Reports and set your desired date range.
  2. Click the Google Sheets button to open the export instructions modal.
  3. If you don’t have an API key yet, click Go to API keys in the modal to create one with at least read scope.
  4. Return to Reports and open the modal again. Copy its CSV URL and append &api_key=YOUR_KEY using your API key. The modal does not automatically insert a key from Settings. Wrap the completed URL in IMPORTDATA, for example:
  5. Paste the formula into any cell in Google Sheets.
The export includes a monthly category breakdown for the selected period, with separate sections for income and expenses. The CSV URL contains your API key as a query parameter so Google Sheets can fetch it without a login session.
Anyone with the CSV URL can read your transaction data. Treat the URL like a secret — do not share it or commit it to version control. If the URL is exposed, revoke the API key immediately and create a new one.

​
Revoking a key

To revoke a key, go to Settings → API Keys, find the key, and click Revoke. Revocation takes effect immediately. Any request using a revoked key receives an unauthorized response. Removing a user from a family also revokes all of their API keys.

​
Security considerations

  • Store API keys as secrets, not in source code or version control.
  • Use a read-only key whenever write access is not required.
  • Revoke keys that are no longer in use.
  • If a key is exposed, revoke it immediately and create a replacement.