Token authentication
Laravel Sanctum bearer tokens, scoped to one business.
Build on top of BikriBook
A token-authenticated REST API for creating invoices and pulling GST reports from your own systems.
What you get
Create invoices
POST /api/v1/documents with line items; tax is computed server-side.
Fetch documents
List and retrieve any document type with filters.
GST reports
GET /api/v1/reports/gstr1 and /gstr3b as JSON.
Same validation
The API uses the identical GST engine as the web app, so results always match.
Tenant isolated
A token can never read another business's data.
How it works
-
1
Create a token
Sanctum bearer tokens, scoped to one business.
-
2
POST an invoice
Send line items; tax is computed server-side by the same engine the app uses.
-
3
Read anything back
List and fetch any document type, with filters.
-
4
Pull GST reports
GSTR-1 and GSTR-3B as JSON, identical to what the web app shows.
Common questions
- Identical. The API and the web app share one TaxCalculator, so results always match.
- Never. Tenant scoping is enforced at the query level, not in the controller.
- Point EINVOICE_DRIVER at sandbox and no request ever reaches the live IRP.