> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dimepayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Dime Payments API.

## Bearer tokens

Every request to the Dime Payments API requires an `Authorization` header with a Bearer token:

```
Authorization: Bearer your-api-token
```

Tokens are Laravel Sanctum personal access tokens. They are minted inside the Dime Payments dashboard -- not via the API itself.

## Getting a token

1. Log into the [Dime Payments dashboard](https://app.dimepayments.com)
2. Click your profile icon in the top right
3. Select **Generate API token**
4. Copy the token immediately -- it will not be shown again

## Token abilities

Every token carries a set of abilities that control which endpoints it can access. If a token lacks the required ability for an endpoint, the API returns a `401 Permission Denied` response.

Common abilities include:

| Ability                         | What it allows                                             |
| ------------------------------- | ---------------------------------------------------------- |
| `transaction:charge-card-token` | Charge a card using a stored token                         |
| `transaction:charge-card-pan`   | Charge a card using raw PAN data (requires PCI compliance) |
| `transaction:charge-ach`        | Charge a bank account                                      |
| `customer:read`                 | List and show customers                                    |
| `customer:write`                | Create, update, and delete customers                       |
| `merchant:read`                 | List and show merchants                                    |
| `merchant:write`                | Create and update merchants                                |

Contact your Dime Payments representative to configure abilities on your token.

## Keeping tokens secure

* Never expose tokens in client-side code or public repositories
* Use environment variables to store tokens in your application
* Generate separate tokens for production and staging environments
* Rotate tokens immediately if you suspect they have been compromised

## Example request

```bash theme={null}
curl --request GET \
  --url https://app.dimepayments.com/api/merchant/list \
  --header 'Authorization: Bearer your-api-token' \
  --header 'Content-Type: application/json'
```

## Error responses

| Status                  | Meaning                                                     |
| ----------------------- | ----------------------------------------------------------- |
| `401 Permission Denied` | Token is missing, invalid, or lacks the required ability    |
| `403 Unauthorized`      | Token is valid but the resource belongs to another merchant |

## Next steps

* [Quickstart](/guides/quickstart) — make your first API call
* [API Reference](/api-reference) — full endpoint documentation