E-Invoicing API Authentication: API Keys
EFact uses secret API keys to authenticate requests. The key identifies and authenticates your organization: you never pass an organization ID in your API calls.
In short
The EFact API authenticates via secret keys prefixed with efact_sk_, transmitted in the Authorization: Bearer header. Each key is tied to a single organization (multi-tenant isolation). SDKs read the key from the EFACT_SECRET_KEY environment variable and attach it automatically to every request.
The secret key
| Type | Prefix | Used by | Access |
|---|---|---|---|
| Secret key | efact_sk_... | Backend only (server-to-server) | All invoice operations for your organization (/v1/invoices) |
Absolute rule: never expose your secret key on the frontend or in a public Git repository. To display an invoice status in a browser, route requests through your backend.
Using the secret key
Via HTTP header
POST /v1/invoices
Authorization: Bearer efact_sk_abc123...
Content-Type: application/jsonVia Node.js SDK
const efact = new EFact(process.env.EFACT_SECRET_KEY!)The secret key is supplied when initializing the client - it is included in every request automatically, exclusively in the Authorization header (never in the URL).
Environments
By default, the SDK targets production (https://api.efact.ma). For local development or test environments, override the base URL:
const efact = new EFact(process.env.EFACT_SECRET_KEY!, {
baseUrl: 'http://localhost:8080',
})Recommended environment variables
# .env (never commit this file)
EFACT_SECRET_KEY=efact_sk_...Important: never commit this file to your Git repository.
Key management in the dashboard
- 1Create a key: Dashboard > API Keys > New Key
- 2View prefix: the full key is only displayed once upon creation - copy it immediately
- 3Revoke a key: Dashboard > API Keys > Revoke - takes immediate effect, rejecting any in-flight requests with that key
- 4Rotation: create a new key, deploy your application with the new value, then revoke the old key
Security and storage of your keys
To ensure maximum protection of your tax data, EFact never stores your secret keys in plaintext.
Only the key fingerprint (a one-way SHA-256 hash of a key with 256 bits of entropy) is retained in the database. Even in the event of an audit or internal breach, no usable key can be retrieved. If you suspect an internal leak, revoking the key from your Dashboard neutralizes it instantly.
Common authentication errors
| HTTP code | Error code | Cause | Resolution |
|---|---|---|---|
401 Unauthorized | API_KEY_MISSING | Missing key or malformed header | Verify Authorization: Bearer efact_sk_... |
401 Unauthorized | API_KEY_INVALID | Invalid or revoked key | Regenerate the key in the dashboard |
429 Too Many Requests | API_KEY_RATE_LIMITED | Over 300 requests/minute with the same key | Respect the Retry-After header (handled automatically by the SDK) |
Frequently asked questions
How do I authenticate with the EFact API?
The EFact API uses secret keys prefixed with efact_sk_, passed in the HTTP Authorization: Bearer header. Every request is mapped to your organization. The Node.js SDK reads the key from an environment variable (EFACT_SECRET_KEY) and attaches it automatically to each call.
How should I protect my EFact API key?
An efact_sk_ secret key must never be exposed client-side or committed to source control. Store it in an environment variable or secrets manager, use separate keys per environment, and rotate it immediately if compromised. Any exposed key must be revoked without delay.
Does an API key grant access to other organizations' data?
No. Each key is tied to a single organization, and the API is strictly partitioned by organization (multi-tenant isolation). A key can only read and modify invoices and settings within its own organization, preventing any cross-tenant data access.