API access
Read your Pinventory data from your own scripts and tools, and let a trusted integration add to it. Tokens are free and belong to one business.
Make a token
Open Settings and find API Access. Only the account owner sees it. Choose Create Token and give it a label you will recognise later, such as the name of the tool that will hold it.
The full token is shown once, at that moment, and never again. Copy it somewhere safe before you close the box. If you lose it, revoke it and make another one: there is nothing to recover.
Every token is scoped to the business you made it in. It cannot reach any other account's data, whatever you ask it for.
Decide whether it can write
A new token reads. That is all it does until you say otherwise, and the Allow writes switch in the create box is what says otherwise.
A writing token can add machines, locations, issue reports, maintenance logs, collections and audit readings. It still cannot change or delete anything, and it cannot sell a game or move one between venues.
The choice is fixed when the token is made. You cannot widen a token later, so a read-only token that turns out to need writes is a new token. This is on purpose: it means a token's power is decided while you are looking at what you are handing it to.
The list shows each token's scope, so you can see at a glance which of your integrations can write.
Every token made before writes existed is read-only, and stays that way. Nothing gained a new power when this shipped.
Call the API
Send the token as a bearer header: `Authorization: Bearer <your token>`. The base address is `api.pinventory.app`, and every path starts with `/v1`.
The full reference lists every field of every resource, and you can try calls against your own data from the page.
Each token is limited to 60 requests a minute and 10,000 a day. Every response tells you what is left, so a well-behaved script can pace itself.
Know what a write does and does not do
A write through the API records the row and writes a line on your activity feed, naming the token that did it. So you can always see which integration added something, and revoke it if it was not what you expected.
It does not do the things the app asks you about. Adding a game at a venue does not update your Pinball Map listing, because a map update is a public edit made under your own account and nobody was there to approve it.
If you have Pinball Map connected, a call that puts a machine on a location has to say `sync_pinball_map` as true or false. Pinventory refuses to guess. Pass false to record the game here, then push it from the machine page when you want the map to follow.
Revoke anything you no longer trust
Revoking is immediate and cannot be undone. The tool holding that token stops working on its next call.
Revoke when a contractor's work ends, when a tool is retired, or the moment you think a token has leaked. Making a replacement takes a few seconds, so there is no reason to leave a doubtful one alive.
Good to know
- Give each tool its own token. One shared token means revoking it breaks everything at once, and the activity feed cannot tell you which tool acted.
- Keep writes off unless a tool genuinely needs them. Most reporting and dashboard work only reads.
- Repeating the same collection within ten minutes does not book the money twice. The API answers with the row it already has, so a timed-out call is safe to retry.
- Expenses need Pro, through the API as well as in the app.