Skip to main content

​
Workspace API tokens

Generate a token in Dashboard → Integrations → Generate Token. Pick a name and the scopes the token needs. The full token is shown once, so copy it right away. Send the token in the Authorization header:
The X-API-Key: <YOUR_API_TOKEN> header is also accepted. A token belongs to one workspace and can only reach devices in that workspace. Revoking a token in Integrations stops it immediately.
Keep API tokens on your server or in CI secrets. Never put them in browser code, mobile apps, or firmware.

​
Scopes

Give each token only the scopes it needs. A token can also be limited to specific device templates.

​
Publishable SDK key

The Device Billing SDK runs in the browser, so it uses a separate publishable key that can only read the menu and create checkouts for one merchant. Find it in Dashboard → Integrations → Browser SDK access, together with the SDK merchantId and the list of Allowed origins. Send both values on every request:
Requests are accepted only from the browser origins you add to Allowed origins.