Create Your API Keys

The Rewards API authenticates requests using an access token tied to your account and restricted to the server IPs you whitelist. This guide shows you how to create your credentials, generate tokens, and use them in API requests.

1. If you're setting up a new integration, start with Step 1.
2. If you already have a Client ID and Secret ID, start with Step 2. Your existing credentials stay the same.

📘

Action recommended for existing integrations

We recommend that all existing Rewards API integrations generate new tokens and confirm their whitelisted IPs are up to date. Follow Step 2, Step 3 and Step 4 below.

Credentials overview

Before you begin

• Make sure you can log in to the Xoxoday Admin Dashboard.
• Collect the IP addresses of the servers that will call the Rewards API.
• Have a secrets manager or other secure storage ready. Credentials and tokens are displayed only once.

Step 1: Generate client ID and Secret ID

Skip this step if you already have a Client ID and Secret ID.

1. In the Xoxoday Admin Dashboard, go to Settings > API.

   

2. On the Storefront Integration tab, click Generate New Tokens.

   

3. Click Save. Copy the Client ID and Secret ID and store them securely.

   

Step 2: Whitelist your server IPs

IP whitelisting for Storefront Integration is handled by our Customer Success team. To add or remove IPs, email [email protected] with:

• Your company name
• The environment (sandbox or production)
• The IP addresses to add or remove

We'll reply to confirm once the changes are in place.

If you have an existing integration, include any IPs that are no longer in use so we can remove them.

Step 3: Generate Access and Refresh tokens

🚧

Generating new tokens immediately invalidates your current tokens

If you have a live integration, be ready to update your systems with the new tokens as soon as you generate them to avoid failed requests.

1. Go to Settings > API and click Generate New Tokens.

   

2. Confirm by clicking Yes, Generate.

   

3. Click Copy Token Details, store the access token and refresh token securely, then click Done.

   

Step 4: Authenticate your requests

Include the access token in the Authorization header of every request:

Authorization: Bearer <your-access-token>

Requests succeed only when the token is valid and the request comes from a whitelisted IP.

If you're updating an existing integration, replace the old tokens in your systems and send a test request to confirm everything works.

Security best practices

• Store credentials and tokens in a secrets manager. Never commit them to source control or embed them in client-side code.
• Whitelist only the servers that call the API, and remove IPs you no longer use.
• If you suspect a token has been exposed, generate new tokens. Your whitelisted IPs don't change.

Next steps

• Set up your environment and make your first API call.