Skip to main content
API tokens authenticate server-to-server calls to /v1/seller/*. Use them when your own backend needs to read Gamecart orders or payment status. Gamecart stores only token hashes and prefixes. The raw token is shown only once when you create or rotate it.
Copy the raw token immediately and store it in your secret manager. Gamecart cannot show the same token again.

​
Before you begin

You need:
  • Access to the Gamecart dashboard.
  • A selected store.
  • Permission to manage integrations for that store.
  • A plan that includes API access.
  • A backend service that can keep secrets outside browser code.

​
Create a token in the dashboard

1

Open the integrations area

In the dashboard, select your store and open Integrations.
2

Open API tokens

Choose API from the integrations menu.
3

Create a token

Click Create token. Use a name that identifies the system that will use it, such as Fulfillment service or Analytics sync.
4

Choose scopes

Select only the scopes your integration needs. Start narrow and add scopes later when the integration requires them.
5

Copy the token

After saving, copy the token shown by Gamecart and store it securely. Treat it like a password.

​
Choose scopes

If you are building delivery automation, start with orders:read and payments:read. Add orders:buyer:read only if the external system needs buyer identity fields.

​
Rotate or revoke a token

Use Rotate when a token may have leaked or when your secret rotation policy requires a new value. Gamecart shows the new raw token once, and the previous value stops working. Use Revoke when an integration is retired or no longer trusted. Revoked tokens cannot authenticate seller API calls.

​
Use a token from your backend

Pass the raw token as a Bearer token:
Never expose the token in storefront JavaScript, public repositories, logs, screenshots, or support messages. Seller API calls are rate limited per token and endpoint. The current default is 120 requests per minute.
  • Create one token per external system.
  • Name tokens after the system, not a person.
  • Keep scopes minimal.
  • Rotate tokens after team member offboarding or suspected leakage.
  • Revoke unused tokens instead of keeping them as backups.