Create, list, update, and revoke API tokens using the API instead of the dashboard. Automate key provisioning and rotation for your integrations.

You can manage the same API tokens available under Developers > API Tokens in the dashboard through the /api/{account_id}/api-tokens endpoints: create, list, get, update, and delete.

Token types

Each API token bundles two credentials:

Both live and sandbox accounts use the _prod_ prefix in production. The token record itself is identified by an id with the tkn_ prefix (e.g., tkn_prod_a1b2c3d4e5f6g7h8).

Authentication

All requests use your existing secret token:

$
curl https://app.paymentkit.com/api/{account_id}/api-tokens \
>
  -H "Authorization: Bearer st_prod_..."

Replace {account_id} with your account’s external id (e.g., acc_prod_...).

Create a token

Generate a new API token. The response includes the full secret_token — this is the only time it is returned, so store it securely.

$
curl -X POST https://app.paymentkit.com/api/{account_id}/api-tokens \
>
  -H "Authorization: Bearer st_prod_..." \
>
  -H "Content-Type: application/json" \
>
  -d '{
>
    "description": "Production key for mobile app",
>
    "expires_at": "2025-12-31T23:59:59Z"
>
  }'

Body parameters (both optional):

Response (ApiTokenWithSecret):

1
{
2
  "id": "tkn_prod_a1b2c3d4e5f6g7h8",
3
  "description": "Production key for mobile app",
4
  "secret_token": "st_prod_secret123xyz",
5
  "secret_token_preview": "st_prod_secr...",
6
  "publishable_token": "pt_prod_abc123xyz",
7
  "is_active": true,
8
  "expires_at": "2025-12-31T23:59:59Z",
9
  "created_at": "2025-01-15T10:00:00Z",
10
  "updated_at": "2025-01-15T10:00:00Z"
11
}

List tokens

Retrieve a paginated list of tokens for the account. The secret_token is never included — only secret_token_preview.

$
curl "https://app.paymentkit.com/api/{account_id}/api-tokens?limit=20" \
>
  -H "Authorization: Bearer st_prod_..."

Query parameters:

The response is a paginated envelope: an items array of token objects, plus total (the total match count) and has_more.

Get a token

Fetch a single token by its id. The response is the token object (without the secret token).

$
curl https://app.paymentkit.com/api/{account_id}/api-tokens/tkn_prod_a1b2c3d4e5f6g7h8 \
>
  -H "Authorization: Bearer st_prod_..."

A token that does not exist, or that belongs to another account, returns 404.

Update a token

Update a token’s description or toggle its is_active status. Only the fields you include in the request body are changed; omitted fields keep their current values. The response is the updated token object (without the secret token).

$
curl -X PATCH https://app.paymentkit.com/api/{account_id}/api-tokens/tkn_prod_a1b2c3d4e5f6g7h8 \
>
  -H "Authorization: Bearer st_prod_..." \
>
  -H "Content-Type: application/json" \
>
  -d '{ "is_active": false }'

Body parameters (both optional):

Deactivating a token (is_active: false) immediately stops it from authenticating requests — any call using its secret token is rejected with 401 — while keeping the token in your list for audit purposes. Set is_active: true to re-enable it.

Revoke a token

Permanently delete a token. This is a hard delete and cannot be undone.

$
curl -X DELETE https://app.paymentkit.com/api/{account_id}/api-tokens/tkn_prod_a1b2c3d4e5f6g7h8 \
>
  -H "Authorization: Bearer st_prod_..."

Response:

1
{ "message": "API token deleted successfully" }

Rotate a token

There is no dedicated rotate endpoint. Rotate a credential by creating a replacement and then retiring the old one:

1. Create a new token and deploy its secret_token to your integration.
2. Verify the new token works in production.
3. Deactivate the old token by sending PATCH with is_active: false (reversible), or delete it (permanent).

Deactivating first and deleting only after a grace period lets you roll back quickly if the new token was misconfigured.

Next steps