API tokens are used to connect your software to PAY.'s technology. A token has a code (AT-1234-1234) and the actual token (between 32 and 64 characters). By default, each merchant has one API token. From the Professional package onward, you can add an unlimited number.
Account or token?
- A person has an account with a username and password and can perform actions. These actions depend on the assigned permissions.
- A system has an API token with a code and hash and can perform actions. These actions depend on the assigned permissions.
IP security
If you choose to add extra security to your API tokens based on IP, you can specify a server list. You will then see a green padlock in your overview in front of the token.
Assigning permissions to tokens
Both an account and an API token are linked to one or more permission groups. Where accounts are often given a combination of permission groups, for an API token it is often sufficient to start a transaction and retrieve the status. If you also want to issue refunds from your software, you must also assign refund permissions.
Tokens are only visible to users with 'All permissions'. If you want to provide your tokens to a third party, you must actively transfer them.
