Overview
API tokens let you interact with your store programmatically. Use them to build custom integrations, automate workflows, or connect third-party tools to your Pandabase store.
You can create up to 25 tokens per store.
Authentication modes
Each token can use one of two authentication modes:
Bearer
Send the token in the Authorization header:
Authorization: Bearer sk_live_...
HMAC
Sign each request with your token’s secret using HMAC-SHA256. The request includes:
X-Pandabase-Token — your token IDX-Pandabase-Timestamp — current Unix timestampX-Pandabase-Signature — HMAC-SHA256 signature of the request
Best for environments where you want to verify request integrity and prevent replay attacks.
Permissions
Tokens have granular permissions that control what they can access. Only grant the permissions your integration needs.
| Permission | Read | Write |
|---|
| Store | View store details | Update store settings |
| Products | List and view products | Create, update, delete products |
| Categories | List and view categories | Create, update, delete categories |
| Coupons | List and view coupons | Create, update, delete coupons |
| Orders | List and view orders, payments | Retry fulfillment |
| Customers | List and view customers | — |
| Webhooks | List and view webhooks | Create, update, delete webhooks |
| Analytics | View analytics data | — |
| Payouts | List and view payouts | — |
| Licenses | List, view, and verify licenses | — |
| Refunds | List and view refunds | Issue refunds |
Secret rotation
You can rotate a token’s secret at any time. The old secret is immediately invalidated. Make sure to update your integration before rotating.
Request logging
All Store API requests are logged automatically with a 30-day retention. Each log entry includes the HTTP method, path, status code, response time, and IP address. View logs in the dashboard or via the API Logs endpoints.
Treat API tokens like passwords. Never expose them in client-side code, public
repositories, or logs. If a token is compromised, rotate or delete it
immediately.
