Overview
Worthic can connect to external tools through API access. An API lets another system talk to your Worthic workspace in a controlled way, without someone signing in through the normal web app each time.
For example, an approved external tool could:
- read selected workspace information
- list accounts, reporting lines, transactions or documents it has permission to see
- upload supporting documents
- submit transactions into Worthic
- connect automation tools, AI assistants or internal business systems to your financial workspace
API access is useful when you want Worthic to work with another system, but it also needs to be handled carefully because it can allow software, not just people, to access your workspace.
API vs MCP
An API is the standard way for software systems to communicate. It usually works through documented web endpoints, such as Worthic’s REST API and OpenAPI documentation. This is the main integration path for developers and external systems.
MCP, or Model Context Protocol, is a newer integration style designed especially for AI tools and assistants. MCP can expose selected Worthic actions as tools an AI assistant can use, such as listing documents or uploading a file. In Worthic, MCP should be understood as a thin adapter over the same permission rules as the normal API.
API access lets approved integrations and AI tools connect securely to your workspace, including through MCP, using only the permissions and reporting lines set by the workspace owner.
In simple terms:
• API: general software integration
• MCP: AI-assistant-friendly integration
• Both: controlled by the access you grant
What API access enables
Depending on the permissions you choose, an API client may be able to:
- read workspace data
- read account and reporting-line information
- read or download documents
- upload documents into Worthic
- submit transactions
- submit transactions for review instead of posting them directly
This can support workflows such as automated document intake, custom dashboards, accounting integrations, AI assistants, internal business tools, or migration/import utilities.
Important risks
API access should be treated like giving a trusted person a key to part of your workspace.
Main risks include:
- a token copied into the wrong place could be used by someone else
- a tool may access more data than it really needs if permissions are too broad
- write access can create or submit records incorrectly if the external tool is misconfigured
- old integrations may continue working unless their tokens are revoked
- downloaded documents or exported data may leave Worthic’s controlled environment
Worthic reduces these risks by using scoped access, roles, audit records, and revocation. A revoked token should stop authenticating immediately.
Best practice
Use the minimum access needed.
For most integrations, start with Viewer access and only enable specific document or transaction permissions if the tool truly needs them. Use Editor access only for systems that must upload documents or submit transactions. Revoke tokens that are no longer used.