Skip to content

Learn about the two authentication methods available for integrating with Cheqi.

Authentication Methods

Cheqi provides two authentication methods to suit different integration scenarios:

API Keys

Direct company access for merchants managing their own receipts.

Learn more about API Keys →

OAuth 2.0 Company Integration

Third-party access for POS systems and integrators.

Learn more about OAuth 2.0 →

Before choosing a credential type, map your organization using Companies, Child Companies, and Stores.

Choosing the Right Method

Use API Keys When:

  • ✅ You are the merchant integrating your own POS system
  • ✅ You need to send receipts from your own systems
  • ✅ One legal company manages one or more store locations

Examples:

  • A restaurant owner integrating their own POS system to send digital receipts
  • A retail company using one API key for all stores that belong directly to that company

Use OAuth 2.0 Company Integration When:

  • ✅ You are a third-party building an integration for multiple merchants
  • ✅ You want merchants to authorize your application to start issuing receipts for them
  • ✅ You are building a POS system, accounting software, or marketplace integration
  • ✅ A corporate group wants one integration to operate for several legal child companies

Example: A POS system provider offering Cheqi integration to all their customers.

A single OAuth authorization can include several companies. Your integration keeps one credential and requests a short-lived access token for the exact legal company handling each sale.

Security Comparison

FeatureAPI KeysOAuth 2.0
Setup ComplexitySimpleModerate
Access ScopeOne exact company and its direct storesGranular scopes per authorized company
Multi-Store SupportYes, within the key's companyYes, within each authorized company
Multi-Company SupportOne company per keyOne integration credential with explicit company grants
Company ApprovalThe company creates its own keyEach legal issuer approves a grant
Credential LifecycleRotate the company key when neededRequest a short-lived company access token through /oauth2/token
Best ForDirect single-company integrationsThird-party and corporate-group integrations

Next Steps