Skip to main content

Authentication (API key)

Számla Agent requests must be authenticated. You can use either an Agent key (recommended) or a username and password.

We recommend using an Agent key instead of a username and password. Use the <szamlaagentkulcs> tag in your XML.

To generate an Agent key, the owner or administrator of the account needs to log in to the Számlázz.hu website and scroll down to the bottom of the dashboard. There is a section called Számla Agent kulcsok (= Számla Agent Keys). Click the key icon on the right side to generate a key. The key is generated immediately and is ready to use.

Agent key generation screenshot

If you use an older webshop that cannot use the <szamlaagentkulcs> tag, you can also provide the key in the <felhasznalo> and <jelszo> tags (use the same key in both fields).

info

Agent keys do not expire; they remain valid indefinitely until manually deleted. All Agent keys in an account have identical permissions: there is no per-key scope or access restriction. A single account can have at most 17 Agent keys; deletion takes effect immediately.

Agent key: API only, case sensitive, use lowercase

The key is for API use only; you cannot log in to the Számlázz.hu website with it. Agent keys are case sensitive. The system accepts the key only in lowercase: if you send it with uppercase letters, authentication may fail.

Keep your Agent key secret

Treat the Agent key like a password: do not store it in version control, do not share it publicly, and do not include it in client-side code. If a key is compromised, delete it immediately and generate a new one.

Alternative: username and password​

We recommend creating a dedicated user for Számla Agent with billing permissions only. The e-mail address for this user should be monitored by people who can act on errors, as error messages are sent to that address.

warning

This user must have access to exactly one billing account. If the user has access to multiple companies, the system cannot determine which account the request belongs to and will return an error (error code 164).

Next steps​

  1. Session cookies: understand how to handle session cookies in your requests
  2. Sending requests: learn how to structure and send XML requests
  3. Error handling: handle authentication and other errors