API tokens
The keys that let a website or a provider read your properties — and how to keep them under control.
An API token is a key that lets an outside program read the properties of one or more of your gateways. It is how your website, or a provider, fetches your listings without having your password.
Creating a token
- 1
Give it a meaningful label.
"Production access", "Main site", "Martin Web Agency". The label has no technical effect, but in six months it tells you who uses this key — and therefore which one you can revoke safely.
- 2
Pick the gateways it covers.
A token only grants access to the gateways you tick. Tick only one if the recipient only needs that one.
- 3
Copy the key and hand it over.
It stays viewable from the list, with a copy button.
Precautions
- One token = one recipient. If you need to cut off a provider, you delete their token without disturbing anyone else.
- Never publish it in a public email, a shared ticket, or a web page source. Whoever has it can read your properties.
- Delete what is no longer used. A former provider, a rebuilt site: the matching token has no reason to exist any more.
You can rename a token at any time — the key itself does not change. Handy for tidying up without breaking anything.