Use bearer authentication with the Bilty API
Send the API client bearer credential to the scoped /bilty_management/api/v1 endpoints and handle denied, expired or rate-limited requests correctly. The guide follows the Help Centre standard: exact route, prerequisites, ordered steps, verification and operational boundaries.
What you’ll accomplish
Send the API client bearer credential to the scoped /bilty_management/api/v1 endpoints and handle denied, expired or rate-limited requests correctly. Bilty Management keeps drafts, issued records, public capability links, finance, integration events and audit evidence as connected but separately verifiable records.
How the workflow fits together
Create scoped API clients, use REST endpoints, idempotency, request logs and signed webhook delivery. Use the module's current status, permission checks, warnings and linked records to decide the next supported action. Where a downstream invoice, WhatsApp queue item, webhook, PDF, POD record or audit event applies, verify it separately.
Follow these steps
- Go to /bilty_management/api/v1.
- Confirm the active tenant, intended Bilty record and your permission before entering or changing data.
- Complete the supported workflow: Send the API client bearer credential to the scoped /bilty_management/api/v1 endpoints and handle denied, expired or rate-limited requests correctly.
- Review the displayed validation, dependent fields and any privacy, finance or integration warning before continuing.
- Save, submit or run the action once and wait for the module response.
- Reopen the relevant register or record and verify the final status, linked records and audit evidence.
Fields and decisions to review
Record, audit and evidence checks
Reopen the relevant Bilty record or register and confirm its identifier, current status, related parties, timestamps and connected evidence. Check the audit/compliance, payment, public-link, report, API, webhook or WhatsApp evidence that applies to this workflow rather than relying only on a success alert.
How to confirm it worked
Return to /bilty_management/api/v1 or the resulting register and verify that the stored state matches the intended action. For any downstream automation, confirm the downstream record or queue/log entry as a separate completion check.
Technical basis for this guidance
This guide was checked against config/routes.php; controllers/Bilty_api_v1.php; controllers/Bilty_management.php; models/Bilty_management_model.php; views/admin/api.php; docs/openapi.yaml. It documents only behaviour exposed or enforced by the supplied module; internal secrets, raw signature payloads and unsupported future workflow assumptions are intentionally excluded.
Controls, checks and common mistakes
- Do not place bearer tokens or webhook secrets in Help Centre screenshots, tickets or logs.
- Scopes, IP allowlists and rate limits should use least privilege.
- Webhook delivery is asynchronous and should be verified from queue/request evidence.