Skip to main content

​
Bearer tokens

Every request to the Dime Payments API requires an Authorization header with a Bearer token:
Tokens are Laravel Sanctum personal access tokens. They are minted inside the Dime Payments dashboard, not via the API itself.

​
Getting a token

  1. Log into the Dime Payments dashboard
  2. In the sidebar, open Advanced > API keys (/user/api-tokens)
  3. Click to create a token, select its abilities, and generate it
  4. Copy the token immediately — it will not be shown again
API access is gated. If your account does not have API access enabled, the API keys item links out to the developer onboarding page instead of the token screen. If you land on the marketing page rather than a token generator, contact your Dime Payments rep to have API access switched on for your account.

​
Token abilities

Every token carries a set of abilities that control which endpoints it can access. You choose these abilities yourself with checkboxes when you mint the token — there is also a payments quick-select preset that grants the common charging scopes in one click. If a token lacks the ability an endpoint requires, the request is rejected (see Permission errors). Two things about the ability model are easy to get wrong: One scope covers all charging operations. A single ability, transaction:charge-card-token, gates charging a card, charging ACH, refunds, voids, tokenization, listing transactions, and every recurring-payment endpoint. There is no separate charge-ach, charge-card-pan, refund, or void scope. Write scopes are granular, not a single :write. Customer, merchant, and invoice writes are split by operation (create, update, delete), not bundled under one :write ability.

​
Merchant token scopes

A merchant API token (minted under Advanced > API keys) can carry any of these 23 scopes:

​
Affiliate key scopes

Affiliate API keys carry a different set of 17 scopes. They add the merchant:* family (affiliates provision merchants) but do not include any subscription or subscription-plan scopes, and their invoice set is smaller:
When you create an affiliate key, three of these scopes are pre-checked as sensible defaults. That default selection is just a starting convenience — you can check or uncheck any of the 17 before generating the key.

​
Keeping tokens secure

  • Never expose tokens in client-side code or public repositories
  • Use environment variables to store tokens in your application
  • Generate separate tokens for production and staging environments
  • Rotate tokens immediately if you suspect they have been compromised

​
Example request

​
Permission errors

When a token is missing, invalid, or lacks the required ability, the API returns a permission error. The exact shape is not uniform: Handle both shapes when checking for authorization failures. See Response Codes for the full breakdown.

​
Next steps