First key, first call

Ten minutes, from a Hela account to the first GET returning your sales.

1. Open the Developers page

In the app, pick the company, then Administration → Developers. The page is visible only with the developers:manage permission; the owner and administrators have it.

You will find three things: the API base address of this server, the company id, and the buttons to create keys and webhooks.

2. Create a key

New key, then:

a name that says what it is for ("Zapier", "Website", "Accounting script");
a mode: live or test. A test key reads real data but every write is refused, which makes it the right tool for development;
scopes: tick the bare minimum. A key that reads sales has no need for inventory:update.

The key is shown only once. Copy it into your secrets manager. It starts with hela_live_ or hela_test_.

3. First call

export HELA_KEY="hela_test_…"
export HELA_API="https://api.example.com/v1"
export COMPANY="4c1d…"   # the id shown on the Developers page

curl -s "$HELA_API/companies/$COMPANY/sales?limit=5" \
  -H "Authorization: Bearer $HELA_KEY" | jq .

The answer is a list of sales. Every amount is an integer in minor units, with its currency: see Companies, documents, money.

4. A write

Switch to a live key, then record a payment on an invoice:

curl -s -X POST "$HELA_API/companies/$COMPANY/sales/<saleId>/payments" \
  -H "Authorization: Bearer $HELA_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: payment-2026-09-28-0001" \
  -d '{ "walletId": "<walletId>", "amount": 125.00, "note": "Transfer received" }'

The Idempotency-Key header is optional but recommended on every write: if your program retries after a network timeout, Hela replays the first answer instead of recording two payments. See Pagination, errors, idempotency.

Request bodies of writes take amounts in major units (125.00), as a person types them; responses return them in minor units (12500). The asymmetry is deliberate: input is for you, storage is for the machine.

5. A webhook

On the same page, New webhook: an HTTPS address and the events you care about. Hela sends a ping at once; the Test button sends it again at will. The secret, shown once, is what verifies the signature of every delivery.

The full OpenAPI schema is served by the server itself: GET /openapi.json, with a browsable UI at /docs.
The TypeScript SDK wraps all of this with types.
Without code: Zapier, Make, n8n.