Skip to content
Open appBook a five-day pilot

Developers & API Access

The Developers page is where you connect other software to DayZero: AI assistants through MCP sign-in, and your own scripts and integrations through API keys. Open Settings > Developers. A status strip at the top shows where MCP and the REST API stand for your account.

Key capabilities

  • Connect an AI assistant (Claude, ChatGPT, Cursor, Claude Code, Codex) with one shared server address and a browser sign-in; no key needed and no approval needed
  • Connected apps list showing what each assistant can do and when it was last active, with disconnect at any time
  • API keys for the REST API: shown once at creation, named, with an optional description
  • Per-key access level: Full access, Read-only, or one of three Partner credit levels
  • Per-key business limit: one business (the default is the one you are working in) or every business you can access
  • Optional IP restrictions (up to 32 addresses or ranges, with Google and AWS presets and an "add my current IP" shortcut)
  • Expiry of 30, 90, 180, or 365 days (default 365), expiry warnings on the list, and up to 10 active keys per user
  • Revoke a key instantly; revoked keys stay listed for reference
  • API clients for partner servers that sign short-lived assertions instead of holding a long-lived key
  • Webhooks that send signed notifications about partner credit lines, with a recent-deliveries log
  • A link to the API reference and to the MCP setup guide

How it works

flowchart LR
  ai["AI assistant"] -->|"Browser sign-in"| mcp["Connected app"]
  req["Request API access"] --> review["DayZero review"]
  review --> key["Generate API key"]
  key --> call["Your code calls the API"]

MCP connections and API keys are separate: revoking one never affects the other. Each API call carries the key in an Authorization header, and a key that is not limited to one business also names the business in an x-business-id header.

How to use it

  1. Open Settings > Developers.
  2. To connect an assistant, use Add to Claude, Add to Cursor, Copy URL (ChatGPT), or copy the Claude Code command or Codex config, then sign in when the browser opens.
  3. For API keys, the first time you will be asked to request access: pick what you are building and explain which data it needs. The page shows Pending review until DayZero emails you a decision.
  4. Once approved, click Generate API key. Two-factor authentication is required; if it is not set up, DayZero offers to open your security settings first.
  5. Name the key, choose its business, access level, expiry, and optional IP restrictions, then create it.
  6. Copy the key immediately and store it in your secrets manager. It is not shown again.
  7. Use the API reference link for examples. The key dialog also shows a ready-to-run test request.
  8. Click Revoke when a key is no longer needed; anything using it stops at once.

Pro tips

  • Create a separate key per integration so you can revoke one without breaking the others.
  • Treat a key like a password. If you lose it, revoke it and create a new one.
  • Give each key the least it needs: Read-only, one business, and your server's IP address.
  • Rotate before expiry: create the replacement, swap it in, then revoke the old key. Keys expiring within 14 days are flagged.
  • If a key suddenly stops working, check whether a firm owner or admin switched off API access for your account on the Staff page.

In-depth guide

Access levels

  • Full access: read and write every endpoint your account can reach.
  • Read-only: GET requests only; anything that creates, updates, or deletes is refused.
  • Partner credit, dashboard: read access to the partner credit API, for a merchant dashboard.
  • Partner credit, payments: write access limited to payment, settlement, and reversal calls, plus a line's payoff quote and payment list. Restrict it to your server IPs.
  • Partner credit, full API: every method on the partner credit API and nothing else.

Requests from an IP outside a key's list, or for a business outside its limit, are refused with a 403 error. A key's IP list and business limit cannot be edited later: create a replacement, swap, then revoke the old key.

Access by request

API keys are off until DayZero approves your request, and every request is reviewed by hand. If one is not approved, you can send a new one with more detail. A firm owner or admin can also switch API access off per user on the Staff page (the API access toggle). They can restrict access, but approval always comes from DayZero. While access is off, that user's keys and automations stop working. If DayZero removes access, your keys are revoked and later approval does not bring them back; generate new ones.

API clients and webhooks

API clients suit partner servers: you register public keys, your servers sign a short-lived assertion, and exchange it for a token that lives minutes, so no long-lived secret leaves your side. Registering a client and adding a signing key also require two-factor authentication, and any secret is shown once. Webhooks let you add an endpoint, save its signing secret when shown, and review recent deliveries; failed deliveries are retried with backoff.

Limits and auditing

Each user may hold up to 10 active keys, and creating keys is rate limited. Key creation and revocation are security-relevant, so pair this page with the Audit Log for security reviews.

Edge cases

  • If you did not copy a key before closing the dialog, revoke it and create another.
  • Until access is approved, or when it is turned off, the page shows the request form or a locked state instead of the generate button.
  • A key cannot create another key; creation happens in the web app with two-factor verification.