> For the complete documentation index, see [llms.txt](https://guides.paynow.gg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://guides.paynow.gg/integrations-and-commands/api-keys.md).

# API Keys

API keys let you drive PayNow programmatically: build a headless storefront, import packages, or wire your store into other systems. Endpoints are documented at [docs.paynow.gg](https://docs.paynow.gg/).

*Dashboard → Integrations → API Keys. Needs `apikey_read`.*

## Creating a key

1. Go to **Integrations → API Keys**.
2. Click **Create**.
3. Give it a **name** and assign a **role**.

The key's page then shows the token, along with options to reset it and when it was last modified.

<figure><img src="/files/plEPVhmsYmDDwyUiPgWS" alt="The API Keys page listing two keys with their names, roles and last-modified dates."><figcaption></figcaption></figure>

## The role is the important field

{% hint style="danger" %}
**A key can do everything its role can do.** The role is the entire security boundary; there is no second layer.

Give each key the narrowest role that lets it work. A key that only reads your catalogue for a storefront should not be able to issue refunds, edit products, or read customer data. If it leaks, the role decides whether you have an inconvenience or an incident. See [Roles](/store-settings/roles.md) and [Permissions Reference](/store-settings/permissions.md).
{% endhint %}

## Naming keys so you can revoke safely

Name each key after where it runs, not what it does: `storefront-prod`, `ci-import`, `discord-bot`, `analytics-script`. When you reset one, the name is the only thing telling you what will break. A key called `api key 1` makes that a guess.

Use one key per consumer. Sharing a key across three systems means one reset takes all three down, and a leak gives you no way to tell which one leaked.

## Keeping keys safe

Never commit a key to a repository; it stays in the git history after you delete the line, so use environment variables or a secrets manager. Never paste one into Discord or a support ticket, screenshots included. Never put one in frontend code, since anything shipped to a browser is public, so a headless storefront needs a server-side layer holding the key. Reset on any suspicion of exposure, or when someone with access leaves.

## Resetting

Resetting issues a new token and **invalidates the old one immediately**. Anything using the old value stops working at once, so update your consumer first or accept the downtime.