Get Started - Fohlio API

Authentication

Fohlio uses token-based authentication. Fetch your token with your email and password, then include it on every request as the Authorization header. Tokens are scoped to your account and inherit your role. Requests without a valid token, or with a revoked token, receive a 401 Unauthorized response. Get your token:

curl -X GET \
   --header 'Accept: application/json' \
   --data-urlencode 'email=YOUR_EMAIL' \
   --data-urlencode 'password=YOUR_PASSWORD' \
   --location 'https://app.fohlio.com/be/openapi/tokens/current'

Use it on a request:

curl -X GET \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_API_TOKEN' \
  --location 'https://app.fohlio.com/be/openapi/users'

Treat your API token like a password. Don’t expose it in client-side code or public repositories — call the API from your server.

Authorization

Every API key carries the same role as its owner in the workspace. Requests are authorized per-endpoint against that role — a key can never do more than the user it belongs to.

Role	Access
Admin	Full read/write access, including managing users, API keys, and workspace settings.
Editor	Read and write access to projects, items, suppliers and orders. Cannot manage users or keys.
Viewer	Read-only access to projects, items, suppliers and orders.

Rate limits

Requests are limited to 120 requests per minute per team. Exceeding this returns a 429 Too Many Requests response. Need a higher limit? Limits are configurable — contact your account manager to adjust them for your team.