# Authentication Overview

Learn about the two authentication methods available for integrating with Cheqi.

## Authentication Methods

Cheqi provides two authentication methods to suit different integration scenarios:

### API Keys

Direct company access for merchants managing their own receipts.

[Learn more about API Keys →](/authentication/api-keys)

### OAuth 2.0 Company Integration

Third-party access for POS systems and integrators.

[Learn more about OAuth 2.0 →](/authentication/oauth)

Before choosing a credential type, map your organization using [Companies, Child Companies, and Stores](/companies/structure).

## Choosing the Right Method

### Use API Keys When:

- ✅ You are the **merchant** integrating your own POS system
- ✅ You need to **send receipts** from your own systems
- ✅ One legal company manages one or more **store locations**


**Examples:**

- A restaurant owner integrating their own POS system to send digital receipts
- A retail company using one API key for all stores that belong directly to that company


### Use OAuth 2.0 Company Integration When:

- ✅ You are a **third-party** building an integration for multiple merchants
- ✅ You want merchants to **authorize your application** to start issuing receipts for them
- ✅ You are building a **POS system, accounting software, or marketplace integration**
- ✅ A corporate group wants one integration to operate for several legal child companies


**Example:** A POS system provider offering Cheqi integration to all their customers.

A single OAuth authorization can include several companies. Your integration keeps one credential and requests a short-lived access token for the exact legal company handling each sale.

## Security Comparison

| Feature | API Keys | OAuth 2.0 |
|  --- | --- | --- |
| **Setup Complexity** | Simple | Moderate |
| **Access Scope** | One exact company and its direct stores | Granular scopes per authorized company |
| **Multi-Store Support** | Yes, within the key's company | Yes, within each authorized company |
| **Multi-Company Support** | One company per key | One integration credential with explicit company grants |
| **Company Approval** | The company creates its own key | Each legal issuer approves a grant |
| **Credential Lifecycle** | Rotate the company key when needed | Request a short-lived company access token through `/oauth2/token` |
| **Best For** | Direct single-company integrations | Third-party and corporate-group integrations |


## Next Steps

- [Get Started with API Keys](/authentication/api-keys) - Generate your first API key in minutes
- [Implement OAuth 2.0](/authentication/oauth) - Build a third-party integration