API Tokens

API tokens allow external applications to access your store's data securely. This guide covers creating, managing, and securing your API tokens.

Creating an API Token

Via Dashboard

1. Log into your store dashboard at https://yourstore.pixlpay.net
2. Navigate to Settings > API Tokens
3. Click Create API Token
4. Fill in the details:
   • Name: Descriptive name (e.g., "Mobile App", "Analytics Dashboard")
   • Description: What this token is used for
   • Rate Limit: Maximum requests per minute (default: 60)
   • Expiration: Optional expiration date
   • Scopes: Select required permissions
5. Click Generate
6. Copy the token immediately - it's only shown once!

Important

Store your token securely. You cannot view the full token again after creation.

Token Scopes

Select only the scopes your integration needs:

Product Scopes

Scope	Description
products:read	Read product information, inventory, pricing
products:write	Create, update, and delete products

Order Scopes

Scope	Description
orders:read	View order details and customer information
orders:write	Fulfill orders, update order status

Customer Scopes

Scope	Description
customers:read	View customer profiles and purchase history
customers:write	Update customer information

Analytics Scopes

Scope	Description
analytics:read	Access revenue reports and sales analytics

Webhook Scopes

Scope	Description
webhooks:read	View webhook endpoints and delivery logs
webhooks:write	Create, update, and delete webhook endpoints

Settings Scopes

Scope	Description
settings:read	View store settings
settings:write	Update store settings

Managing Tokens

View Token Details

Click on any token in the dashboard to view:

• Token name and description
• Active scopes
• Rate limit configuration
• Last used timestamp
• Usage statistics
• Recent API calls

Usage Statistics

Monitor how each token is being used:

• Total API calls: Lifetime request count
• Calls today: Requests in the last 24 hours
• Top endpoints: Most frequently accessed resources
• Success rate: Percentage of successful requests
• Average response time: Performance metrics

Rotate Token

If you suspect a token has been compromised:

1. Click on the token in your dashboard
2. Click Rotate Token
3. A new token will be generated
4. The old token is immediately invalidated
5. Copy the new token and update your integration

Revoke Token

To permanently disable a token:

1. Click on the token
2. Click Revoke Token
3. Confirm the action
4. The token is immediately deactivated

This action cannot be undone

Revoking a token will immediately break any integrations using it.

Update Token Settings

You can update these settings without changing the token:

• Name and description
• Rate limit
• Scopes (add or remove permissions)
• Expiration date

Common Use Cases

1. Mobile App Integration

Recommended scopes: products:read, orders:read, customers:read

For displaying products and orders in a mobile app.

2. Custom Analytics Dashboard

Recommended scopes: analytics:read, orders:read, products:read

For building custom reports and visualizations.

3. Order Fulfillment System

Recommended scopes: orders:read, orders:write

For automatically processing and fulfilling orders.

4. Inventory Management

Recommended scopes: products:read, products:write

For syncing inventory with external systems.

5. Customer Portal

Recommended scopes: customers:read, orders:read

For allowing customers to view their orders and account.

6. Webhook Management

Recommended scopes: webhooks:read, webhooks:write

For programmatically managing webhook endpoints.

Best Practices

Security

1. Never share tokens publicly - Treat API tokens like passwords
2. Use specific scopes - Only grant the minimum permissions needed
3. Set expiration dates - For temporary integrations or testing
4. Rotate regularly - Change tokens periodically for security
5. Monitor usage - Review API call logs for suspicious activity

Organization

1. Use descriptive names - "Production Mobile App" not "Token 1"
2. One token per integration - Don't reuse tokens across different apps
3. Document token usage - Keep track of where each token is used
4. Set appropriate rate limits - Prevent accidental API abuse

Rate Limits

Configure rate limits based on your integration's needs:

Use Case	Recommended Limit
Low-frequency polling	10-30 req/min
Real-time dashboard	60-120 req/min
Bulk operations	120-300 req/min
High-volume sync	300+ req/min

Troubleshooting

Token Not Working

1. Check token is active - Verify status in token management
2. Check expiration - Token may have expired
3. Verify scopes - Ensure token has required permissions
4. Check rate limit - You may have exceeded requests per minute
5. Verify subdomain - Token is tenant-specific

Rate Limit Exceeded

If you see "429 Too Many Requests":

1. Check current rate limit in token settings
2. Implement request throttling in your application
3. Increase rate limit if needed
4. Wait for rate limit window to reset (shown in headers)

Permission Denied

If you see "403 Forbidden":

1. Check which scopes are assigned to the token
2. Add required scopes in token settings
3. Ensure you're accessing the correct endpoint

Related

• Authentication - How authentication works
• Quick Start - Make your first API call