# How to connect to DualEntry

This guide walks you through connecting your DualEntry account to Apideck through the Vault interface.

DualEntry authenticates with a long-lived API key rather than OAuth: there is no redirect or authorization flow. The key is generated by your own organisation's DualEntry administrator directly in the DualEntry dashboard; generating one is admin-only, but there is no support ticket or partner-approval step to obtain it.

## Prerequisites

- An active DualEntry account
- Organisation administrator access in DualEntry, or an administrator who can generate the key for you: **only an administrator can create an API key**
- If you plan to test in DualEntry's separate Development environment, a DualEntry-provisioned development organisation: see [Environments](#environments) below

## Steps

### 1. Generate your API key in DualEntry

1. Sign in to the DualEntry dashboard as an organisation administrator.
2. Go to **Settings → Organization → Developer access**.
3. Generate a new API key.
4. **Copy the key immediately.** DualEntry displays it only once, at creation, and cannot show it again: a key can only be *regenerated*, never retrieved. If you lose it, an administrator regenerates it, and regenerating **immediately invalidates the previous key** (see [Notes](#notes) on rotation).

For background on the authentication scheme, see [DualEntry's authentication guide](https://docs.dualentry.com/developers/guides/how-to-authenticate-your-requests).

### 2. Connect in Apideck Vault

1. Find the **DualEntry** connector in the available integrations.
2. Paste your API key into the **API Key** field. This is stored as a sensitive credential.
3. Set **Environment** to **Production** or **Development**, matching the environment the key was generated in (defaults to Production if left unset).
4. Optionally, choose a **Default Company** to scope requests to a single company. Leaving this on **All companies** returns records across your entire DualEntry tenant.
5. Save your connection.

## Environments

DualEntry runs Production and Development as separate systems with separate organisations and separate keys:

- **Production** (`api.dualentry.com`): your live accounting data.
- **Development** (`api-dev.dualentry.com`): a separate DualEntry organisation for testing. There's no self-service signup for it; ask your DualEntry administrator or account contact to provision a development organisation, then generate a Development key the same way as above.

A Production key will not authenticate against Development, or vice versa: the two environments don't share credentials, and a key is locked to the environment it was created in. If your requests suddenly fail authentication after working before, check that the connection's **Environment** setting still matches the key you're using.

## Notes

- **The key is shown once.** Store it in an environment variable or secret manager as soon as you generate it: DualEntry does not let you view it again later. If it's lost, an administrator must regenerate it.
- **Rotation has no grace period.** The key doesn't rotate or expire on its own, so rotation is something you do deliberately (e.g. after an admin leaves, or on your own security schedule). When an administrator regenerates the key, **the old key stops working immediately**: there is no overlap window. Update the credential in Vault at the same time you regenerate it to avoid an authentication gap.
- **Multi-company tenants.** If your DualEntry organisation has more than one company and you leave **Default Company** unset, reads span every company in the tenant. Set a Default Company on the connection, or pass `x-apideck-company-id` per request, if you want requests scoped to one company. (Master data such as customers, suppliers, and ledger accounts is org-wide and isn't affected by company scoping.)
- **Rate limits.** DualEntry enforces per-key and per-endpoint request limits, including a lower cap on invoice create/update. See [DualEntry's rate limiting guide](https://docs.dualentry.com/developers/guides/rate-limiting) for the current figures and how to request an increase.

## Troubleshooting

- **"Unauthorized" or authentication failures**: Confirm the connection's **Environment** setting matches the environment the key was generated in: a Development key will not work against Production, and vice versa. If the key was recently regenerated, the previous value stopped working immediately; paste the newly generated key into the **API Key** field.
- **Can't find or recreate a lost key**: DualEntry doesn't store the key for later retrieval. Ask your organisation administrator to regenerate it in **Settings → Organization → Developer access**: note this invalidates the old key at once, then update the connection with the new value.
- **Requests returning data from the wrong company**: Set **Default Company** on the connection, or pass `x-apideck-company-id` per request, rather than relying on the tenant-wide default.
- **Hitting rate limits**: See [DualEntry's rate limiting guide](https://docs.dualentry.com/developers/guides/rate-limiting) for current limits and how to request a higher allowance for your organisation.