Guides

Create a key with read access only; a dashboard never needs to write. Fetch the reports you need on a schedule and keep within the key's per-minute limit by watching X-RateLimit-Remaining.

curl https://api.kumry.com/reports/profit-and-loss \
  -H "Authorization: Bearer $KUMRY_API_KEY"

1. Add a webhook subscribed to invoicing.invoice.paid (and invoicing.invoice.payment_recorded if you care about part-payments).
2. In your endpoint, verify the kumry-signature header against the raw body.
3. Record the kumry-event-id and skip any event you have already seen.
4. Answer 200 straight away and do the follow-up work, such as releasing an order, in the background.

The webhooks page has a verification example.

• API keys: rotate the key in Settings → Integrations, deploy the new secret, and the old key keeps working for 24 hours while you roll out.
• Webhook secrets: rotate the signing secret, then update your endpoint to verify with the new one. New deliveries are signed with the new secret straight away; any your endpoint rejects in the meantime are retried on the usual schedule.
• Set an expiry on keys used by short-lived projects so they cannot outlive them.