API Keys

Create and manage API tokens for headless storefronts, imports and automation.

API keys let you drive PayNow programmatically: build a headless storefront, import packages, or wire your store into other systems. Endpoints are documented at docs.paynow.gg.

Dashboard → Integrations → API Keys. Needs apikey_read.

Creating a key

1. Go to Integrations → API Keys.

2. Click Create.

3. Give it a name and assign a role.

The key's page then shows the token, along with options to reset it and when it was last modified.

The role is the important field

A key can do everything its role can do. The role is the entire security boundary; there is no second layer.

Give each key the narrowest role that lets it work. A key that only reads your catalogue for a storefront should not be able to issue refunds, edit products, or read customer data. If it leaks, the role decides whether you have an inconvenience or an incident. See Roles and Permissions Reference.

Naming keys so you can revoke safely

Name each key after where it runs, not what it does: storefront-prod, ci-import, discord-bot, analytics-script. When you reset one, the name is the only thing telling you what will break. A key called api key 1 makes that a guess.

Use one key per consumer. Sharing a key across three systems means one reset takes all three down, and a leak gives you no way to tell which one leaked.

Keeping keys safe

Never commit a key to a repository; it stays in the git history after you delete the line, so use environment variables or a secrets manager. Never paste one into Discord or a support ticket, screenshots included. Never put one in frontend code, since anything shipped to a browser is public, so a headless storefront needs a server-side layer holding the key. Reset on any suspicion of exposure, or when someone with access leaves.

Resetting

Resetting issues a new token and invalidates the old one immediately. Anything using the old value stops working at once, so update your consumer first or accept the downtime.