# Welcome to the iCount API
The iCount API gives you programmatic access to nearly every feature of the system — clients, documents, payments, expenses, inventory, reports, and more. It is actively maintained and continuously expanded.
All endpoints accept `POST` requests with a JSON-encoded payload and return JSON responses. The base URL is:
```
https://api.icount.co.il/api/v3.php/
```
Before sending any request, you must authenticate. The API supports **three authentication methods**, each suited to a different use case.
---
## Method 1 — API Token (Recommended)
Generate a long-lived API token from the API Tokens settings page and send it in the `Authorization` header as a Bearer token. **This is the recommended method for all integrations.**
Each token is linked to a specific user account and inherits **exactly the same privileges and permissions** as that user. A token can never do more than the user it belongs to — if you need restricted access, create a dedicated user with limited permissions and generate the token under that user.
When to use it
- Server-to-server integrations.
- Background jobs, cron tasks, webhooks, mobile apps.
- Any production workload that needs a stable, revocable credential.
Benefits
- No expiration — works until you explicitly revoke it.
- Username and password are never transmitted.
- Revocable and rotatable independently of user credentials.
- Clean separation between auth and request payload.
- Works with standard Bearer-token HTTP tooling.
Drawbacks
- Tokens must be stored securely (treat them like passwords).
- If leaked, they grant access until revoked.
**Example**
```bash
curl -X POST 'https://api.icount.co.il/api/v3.php/client/get_list' \
-H 'Authorization: Bearer XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX' \
-H 'Content-Type: application/json' \
-d '{}'
```
---
## Method 2 — Session ID (`sid`)
Authenticate once via the [`auth/login`](#/module/auth/login) endpoint, receive a session ID, and reuse it for subsequent requests.
A session remains valid for **20 minutes** from the last request — every new request resets the timer. Once expired, you must log in again.
When to use it
- Interactive apps where a user is actively working (dashboards, internal tools).
- Workloads that make many requests in a short time window.
Benefits
- Credentials are sent only once, reducing exposure.
- Faster than sending credentials on every request.
- Sliding expiration keeps active sessions alive automatically.
Drawbacks
- Expires after 20 minutes of inactivity — not ideal for long background jobs unless you handle re-login.
- Requires storing and refreshing the
sid.
**Step 1 — Log in:**
```bash
curl -X POST 'https://api.icount.co.il/api/v3.php/auth/login' \
-H 'Content-Type: application/json' \
-d '{
"cid": "your-company-id",
"user": "your-username",
"pass": "your-password"
}'
```
The response contains a `sid` field.
**Step 2 — Use the `sid` on subsequent requests:**
```bash
curl -X POST 'https://api.icount.co.il/api/v3.php/client/get_list' \
-H 'Content-Type: application/json' \
-d '{
"sid": "the-session-id-you-received"
}'
```
---
## Method 3 — Credentials on Every Request
Send your `cid` (company ID), `user`, and `pass` as part of the request body for every call.
When to use it
- Quick one-off scripts or testing.
- Environments where storing a token or session is not practical.
Benefits
- Simplest to get started — no extra setup, no token management.
- Stateless: each request is fully self-contained.
Drawbacks
- Credentials travel with every request, increasing exposure risk.
- Slower: the server re-authenticates on each call.
**Example**
```bash
curl -X POST 'https://api.icount.co.il/api/v3.php/client/get_list' \
-H 'Content-Type: application/json' \
-d '{
"cid": "your-company-id",
"user": "your-username",
"pass": "your-password"
}'
```
---
## Quick Comparison
- Best forProduction integrations
- SetupGenerate once in the UI
- ExpirationNone (until revoked)
- SecurityBest — credentials never sent
- Best forInteractive apps
- SetupOne login call
- Expiration20 min sliding
- SecurityBetter — credentials sent once
- Best forQuick scripts, testing
- SetupNone
- ExpirationN/A
- SecurityLowest — sent every call
---
Once you've chosen an authentication method, send a `POST` request to the desired endpoint with your JSON payload. Browse the modules in the sidebar to explore the full list of available endpoints.