Contazen API Documentation

Overview

The Contazen API uses Bearer token authentication. All API requests must include a valid API key in the Authorization header.

API Keys

Key Type

Live Keys

Format: sk_live_ + 24 charactersUse for production. All actions affect real data and can’t be undone.

Creating API Keys

Access API Settings

Create New Key

Click “Create New API Key” and configure:

Name: Identify your key (e.g., “Production Server”)
Permissions: Select required scopes
IP Restrictions: Optionally limit to specific IPs

Copy Your Key

Your secret key will only be shown once. Store it securely in your environment variables.

Testing in Documentation

To test API endpoints directly in this documentation:

Navigate to any API endpoint page (e.g., List Clients)
Look for the “Try it” section
In the Authorization field, enter: Bearer sk_live_YOUR_API_KEY
Fill in any required parameters
Click “Send Request” to test with real data

Making Authenticated Requests

Include your API key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

curl https://api.contazen.ro/v1/clients \
  -H "Authorization: Bearer sk_live_YOUR_API_KEY"

const headers = {
  'Authorization': 'Bearer sk_live_YOUR_API_KEY',
  'Content-Type': 'application/json'
};

fetch('https://api.contazen.ro/v1/clients', { headers })
  .then(response => response.json())
  .then(data => console.log(data));

import requests

headers = {
    'Authorization': 'Bearer sk_live_YOUR_API_KEY',
    'Content-Type': 'application/json'
}

response = requests.get(
    'https://api.contazen.ro/v1/clients',
    headers=headers
)

$headers = [
    'Authorization: Bearer sk_live_YOUR_API_KEY',
    'Content-Type: application/json'
];

$ch = curl_init('https://api.contazen.ro/v1/clients');
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);

Security Best Practices

Use Environment Variables

Never hardcode API keys in your source code. Use environment variables instead:

// Good
const apiKey = process.env.CONTAZEN_API_KEY;

// Bad
const apiKey = 'sk_live_abc123...'; // Never do this!

Implement IP Restrictions

Limit API key usage to specific IP addresses:

Single IP: 192.168.1.1
CIDR range: 192.168.1.0/24
Multiple IPs: Add one per line

Rotate Keys Regularly

Create a rotation schedule:

Create new API key
Update your application
Monitor for issues
Revoke old key after confirming

Multi-Work-Point Access

API keys have access to all work points (branches) within the same parent company. This allows you to manage data across multiple locations with a single API key.

To specify a work point for an API request, include the work_point_id parameter:

curl https://api.contazen.ro/v1/invoices \
  -H "Authorization: Bearer sk_live_YOUR_API_KEY" \
  -d "work_point_id=WORK_POINT_ID"

const response = await fetch('https://api.contazen.ro/v1/invoices', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_live_YOUR_API_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    work_point_id: 'WORK_POINT_ID',
    // ... other invoice data
  })
});

Authentication Errors

When authentication fails, you’ll receive a 401 Unauthorized response:

{
  "success": false,
  "error": {
    "message": "Invalid API key",
    "type": "authentication_error",
    "code": "invalid_api_key",
    "status": 401
  },
  "meta": {
    "version": "v1",
    "response_time": "2.3ms"
  }
}

Common Error Codes

Code	Description	Solution
`missing_api_key`	No Authorization header	Include the header
`invalid_api_key`	Key doesn’t exist	Check your key
`expired_api_key`	Key has expired	Create a new key
`ip_restricted`	Request from unauthorized IP	Update IP whitelist
`insufficient_permissions`	Key lacks required scope	Update key permissions

Testing Authentication

Verify your setup with this simple test:

# Test authentication
curl -I https://api.contazen.ro/v1/clients \
  -H "Authorization: Bearer YOUR_API_KEY"

# Success: HTTP 200
# Failed: HTTP 401

// Test authentication
async function testAuth() {
  try {
    const response = await fetch('https://api.contazen.ro/v1/clients', {
      headers: {
        'Authorization': `Bearer ${process.env.CONTAZEN_API_KEY}`
      }
    });
    
    if (response.ok) {
      console.log('✅ Authentication successful');
    } else {
      console.log('❌ Authentication failed:', response.status);
    }
  } catch (error) {
    console.error('Error:', error);
  }
}

testAuth();

Troubleshooting

Headers Not Received

Some servers strip the Authorization header. Add to .htaccess:

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

CORS Issues

For browser requests, the API includes CORS headers:

Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Authorization, Content-Type

Need Help?

If you’re having authentication issues:

Double-check your API key
Verify you’re using a valid API key
Check rate limits
Review IP restrictions
Contact support with your request ID

Getting Started

Core Concepts

Authentication

Overview

API Keys

Key Type

Live Keys

Creating API Keys

Testing in Documentation

Making Authenticated Requests

Security Best Practices

Multi-Work-Point Access

Authentication Errors

Common Error Codes

Testing Authentication

Troubleshooting

Need Help?

​Overview

​API Keys

​Key Type

Live Keys

​Creating API Keys

​Testing in Documentation

​Making Authenticated Requests

​Security Best Practices

​Multi-Work-Point Access

​Authentication Errors

​Common Error Codes

​Testing Authentication

​Troubleshooting

​Need Help?

Overview

API Keys

Key Type

Creating API Keys

Testing in Documentation

Making Authenticated Requests

Security Best Practices

Multi-Work-Point Access

Authentication Errors

Common Error Codes

Testing Authentication

Troubleshooting

Need Help?