API tokens let you authenticate requests to Loop's API, so you can build integrations with your store systems. Webhook secrets let you verify that incoming webhook requests were actually sent by Loop, protecting your systems from spoofed calls. This article covers how to generate and manage both from your Loop admin.
Step-by-step process to generate Loop API tokens.
Go to the "Settings" tab and click on "API tokens & webhooks"
Click on "Generate Token" button.
In the "Generate Token" popup, enter the name for token (helpful for managing multiple tokens) and required scopes. You can select "Read only" or "Read & write" for each scope type.
Click on "Generate" button the complete the process.
That's it. The new generated token will be visible on the screen along with the name and scopes. Tokens are shown in descending order of their generation time.
Here are a few articles that you may find helpful, and we suggest you go through the same : API Documentation
Step-by-step process to generate webhook secrets.
Webhook secrets are used to verify that incoming webhook requests were sent by Loop. You can generate them from the same page where you manage your API tokens.
Go to the "Settings" tab and click on "API tokens & webhooks." Then click on the "Webhook secrets" tab.
Click on "Generate webhook secret."
The secret key is shown in the pop-up modal. This is the only time this secret will be shown. Copy it now and store it somewhere safe, such as a password manager - you won't be able to view it again.
Click on Done and the new secret key appears in the list, along with the date it was generated.
Note: You can generate up to 3 active webhook secret keys per store at a time.
Generating a new secret key before revoking an old one lets you rotate keys without any downtime in signature verification. Click "Revoke" next to a key to remove it once it is no longer in use.
For implementation details and sample code, please refer to our documentation:
Verifying Webhook Signatures
FAQs
I successfully generated my token, but its value is masked.
I successfully generated my token, but its value is masked.
For security reasons, the tokens are default hidden, which can be viewed by clicking on the link "Show token".
How can I change my token name and scopes?
How can I change my token name and scopes?
You can edit the name and token scopes anytime by clicking on the "Edit" button. The token will remain unchanged.
Can I delete the generated tokens? What would happen if an API call is made using the deleted token?
Can I delete the generated tokens? What would happen if an API call is made using the deleted token?
You can easily delete a token by clicking on "Remove" button. You will be asked to confirm before deleting the token. Once deleted, the token cannot be recovered again. Any API calls made with this token will give "invalid token"
Need help?
No worries - we're here for you!
If you have any questions or need assistance, feel free to email us at [email protected] or chat with us using the support beacon at the bottom right of your screen.
Regards,
Loop Subscriptions Team 🙂