> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gamecart.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# API tokens

> Create seller API tokens from the Gamecart dashboard

API tokens authenticate server-to-server calls to `/v1/seller/*`. Use them when your own backend needs to read Gamecart orders or payment status.

Gamecart stores only token hashes and prefixes. The raw token is shown only once when you create or rotate it.

<Warning>
  Copy the raw token immediately and store it in your secret manager. Gamecart cannot show the same token again.
</Warning>

## Before you begin

You need:

* Access to the Gamecart dashboard.
* A selected store.
* Permission to manage integrations for that store.
* A plan that includes API access.
* A backend service that can keep secrets outside browser code.

## Create a token in the dashboard

<Steps>
  <Step title="Open the integrations area">
    In the dashboard, select your store and open **Integrations**.
  </Step>

  <Step title="Open API tokens">
    Choose **API** from the integrations menu.
  </Step>

  <Step title="Create a token">
    Click **Create token**. Use a name that identifies the system that will use it, such as `Fulfillment service` or `Analytics sync`.
  </Step>

  <Step title="Choose scopes">
    Select only the scopes your integration needs. Start narrow and add scopes later when the integration requires them.
  </Step>

  <Step title="Copy the token">
    After saving, copy the token shown by Gamecart and store it securely. Treat it like a password.
  </Step>
</Steps>

## Choose scopes

| Scope               | Choose it when                                                   |
| ------------------- | ---------------------------------------------------------------- |
| `orders:read`       | Your integration needs to list orders or fetch order details.    |
| `payments:read`     | Your integration needs to check payment status for an order.     |
| `orders:buyer:read` | Your integration needs buyer name, email, or account identifier. |

If you are building delivery automation, start with `orders:read` and `payments:read`. Add `orders:buyer:read` only if the external system needs buyer identity fields.

## Rotate or revoke a token

Use **Rotate** when a token may have leaked or when your secret rotation policy requires a new value. Gamecart shows the new raw token once, and the previous value stops working.

Use **Revoke** when an integration is retired or no longer trusted. Revoked tokens cannot authenticate seller API calls.

## Use a token from your backend

Pass the raw token as a Bearer token:

```http theme={"dark"}
GET /v1/seller/orders
Authorization: Bearer gci_...
```

Never expose the token in storefront JavaScript, public repositories, logs, screenshots, or support messages.

Seller API calls are rate limited per token and endpoint. The current default is `120` requests per minute.

## Recommended setup

* Create one token per external system.
* Name tokens after the system, not a person.
* Keep scopes minimal.
* Rotate tokens after team member offboarding or suspected leakage.
* Revoke unused tokens instead of keeping them as backups.