Keys and environments

Where your key is

1. Log in to the account of the environment you'll use: sandbox-app.facturadigital.com.mx for tests or app.facturadigital.com.mx for production.
2. Go to Configuración › API y desarrolladores.
3. Copy the Llave vigente (current key) as shown. It's already in the format the header expects.

That screen also shows the Llave anterior (previous key), the format older integrations used. It works until June 30, 2027; while you use it, every response carries the X-FD-ApiKey-Deprecation header with the cutoff date. Move your integration to the current key before then.

How to send it

In the X-Api-Key header of every request. There's nothing to sign and no token to request first. POST requests send their body as a form (application/x-www-form-urlencoded), except stampxmlfile, which sends a file.

curl -sS "https://sandbox-app.facturadigital.com.mx/api/v5/account/balance" \
  -H "X-Api-Key: $FD_API_KEY"

const res = await fetch("https://sandbox-app.facturadigital.com.mx/api/v5/account/balance", {
  headers: { "X-Api-Key": process.env.FD_API_KEY },
});

$ch = curl_init('https://sandbox-app.facturadigital.com.mx/api/v5/account/balance');
curl_setopt($ch, CURLOPT_HTTPHEADER, ['X-Api-Key: ' . getenv('FD_API_KEY')]);

requests.get("https://sandbox-app.facturadigital.com.mx/api/v5/account/balance",
             headers={"X-Api-Key": os.environ["FD_API_KEY"]})

Sandbox and production

They're two separate accounts, each with its own data, folios and keys. Nothing you do in the sandbox touches your production CFDIs. To go live you change the base URL and the key; the code stays the same.

If the key doesn't work

All of these respond HTTP 400 with code 501. The end of the message names the environment that answered, for example [Environment: SANDBOX].

Your folio balance

Returns the available folios of the key's account. It's the simplest request to confirm the key and the URL belong to the same environment.

{
  "message": "10 credits available.",
  "balance": 10,
  "code": 200
}

Get the key through the API

If your system needs to read the key without opening the screen, account/authorize returns it in exchange for the platform username and password, in the API-USUARIO and API-PASSWORD headers. Call it only from your server and over HTTPS: the password travels with it.

With a wrong username or password it responds HTTP 401 with code 502. After several failed attempts from the same IP it responds HTTP 403 with code 503 until the block wears off.