> Markdown version of https://docs.paynow.gg/guides/integrations-and-commands/api-keys/. The index of all pages is at https://docs.paynow.gg/llms.txt, and any page can be read as Markdown by appending `.md` to its URL.

# API Keys

Create and manage API tokens for headless storefronts, imports and automation.

API keys let you drive PayNow programmatically: build a [headless storefront](https://docs.paynow.gg/self-hosted-webstores/introduction/), import packages, or wire your store into other systems. Endpoints are documented at [docs.paynow.gg](https://docs.paynow.gg/getting-started/introduction/).

*Dashboard → Integrations → API Keys. Needs `apikey_read`.*

## Creating a key

1. Go to **Integrations → API Keys**.
2. Click **Create**.
3. Give it a **name** and assign a **role**.

The key's page then shows the token, along with options to reset it and when it was last modified.

![The API Keys page listing two keys with their names, roles and last-modified dates.](https://docs.paynow.gg/guides/integrations-and-commands/api-keys/api-keys-01.png)

## The role is the important field

> **A key can do everything its role can do.** The role is the entire security boundary; there is no second layer.

> Give each key the narrowest role that lets it work. A key that only reads your catalogue for a storefront should not be able to issue refunds, edit products, or read customer data. If it leaks, the role decides whether you have an inconvenience or an incident. See [Roles](https://docs.paynow.gg/guides/store-settings/roles/) and [Permissions Reference](https://docs.paynow.gg/guides/store-settings/permissions/).

## Naming keys so you can revoke safely

Name each key after where it runs, not what it does: `storefront-prod`, `ci-import`, `discord-bot`, `analytics-script`. When you reset one, the name is the only thing telling you what will break. A key called `api key 1` makes that a guess.

Use one key per consumer. Sharing a key across three systems means one reset takes all three down, and a leak gives you no way to tell which one leaked.

## Keeping keys safe

Never commit a key to a repository; it stays in the git history after you delete the line, so use environment variables or a secrets manager. Never paste one into Discord or a support ticket, screenshots included. Never put one in frontend code, since anything shipped to a browser is public, so a headless storefront needs a server-side layer holding the key. Reset on any suspicion of exposure, or when someone with access leaves.

## Resetting

Resetting issues a new token and **invalidates the old one immediately**. Anything using the old value stops working at once, so update your consumer first or accept the downtime.