Security and API keys

Data living safely in Monument is only half the job; it also has to be protected and, when useful, connected outward. The Security tab covers both sides of protecting the account, two-factor auth and session visibility, and the credentials integrations use to talk to Monument. Connecting your accounting system lives a tab over, under Integrations, linking Monument's invoices to the ledger you actually keep books in.

This is the last setup step for Northlight Architects: mint a key for a reporting integration, connect Xero, and see where two-factor auth and session control are headed.

Three jobs, one tab plus one

Prove it's actually you. Two-factor authentication and session management protect people, not software: a second factor and visibility over active sessions mean a leaked password alone isn't enough to get in.

Let trusted software in. An API key is how something external, a custom dashboard, a script, talks to Monument's Public REST API on your behalf. It's a credential you create on purpose and can kill the instant it's unwanted.

Bridge to your books. Connecting Xero, QuickBooks or MYOB lets invoices and payment status flow between Monument and your ledger, so nothing gets keyed in twice.

Two-factor authentication and sessions

At the top of the Security tab sit the two controls that harden the account itself. Two-Factor Authentication adds a second step to signing in, so a leaked password alone can't get into Northlight's books. Session Management shows everywhere the account is currently signed in, useful for signing out a laptop left logged in at a client's office.

Create an API key

Further down the Security tab, API Keys is where credentials for integrations get created. Each key gets a name (and an optional expiry), and there's one moment that matters more than the rest: the full key is shown exactly once, immediately after creation. Copy it then, because Monument never displays it again.

1. 1

   On the Security tab, in API Keys, click Create Key.

2. 2

   Give it a clear name, like Reporting Dashboard, and a description so future-you knows what it's for.

3. 3

   Optionally set an expiration date, then create the key.

4. 4

   Copy the full key from the success dialog and store it somewhere safe, since it won't show again.

   

Connect your accounting system

Connecting your ledger turns Monument's invoices into entries in the books without double entry, and it lives on the Integrations tab. Pick Xero, QuickBooks or MYOB, authorise through the provider's own sign-in, then set a default sales account and tax type and decide whether payment status syncs back.

1. 1

   Go to Settings, then Integrations, and find Accounting Integration.

2. 2

   Choose your system, Xero, QuickBooks or MYOB, and click Connect to authorise through the provider.

3. 3

   Once connected, set the Default Sales Account and Default Tax Type used when invoices sync.

4. 4

   Decide whether payment status syncs back into Monument, and you're done.

Troubleshooting

• The key really is shown once. There's no "reveal" screen afterward; only the prefix persists for display. Miss the copy, and revoking and recreating is the only fix.
• Revoke is instant and total. It doesn't pause a key, it kills it: any integration using it loses access the moment you click. Have the replacement ready first.
• Accounting isn't on the Security tab. Two-factor, sessions and API keys sit under Security; the accounting connection sits under Integrations. Same job, two tabs.

Where this fits next

Northlight is set up, secured and connected. To see the accounting bridge actually carry invoices across, read Accounting sync for how invoices and payments flow between Monument and your ledger.