Skip to main content

​
What API keys are for

An API key (or token) lets another system talk to your Dime Payments account, such as a WooCommerce store, a Zapier automation, or a custom integration. Each key is a secret, so treat it like a password. Find your keys in the sidebar under Advanced > API keys.
Tokens are personal access tokens for the Dime API, tied to your user account rather than to a single merchant. If your account does not have API access enabled yet, the API keys menu links to a developer onboarding page instead. If that happens, contact your Dime Payments representative to have API access switched on.

​
Creating a token

1

Name the token

Click Create API token and give it a token name that identifies where it will be used, for example “Production server.”
2

Choose permissions

Turn on only the permissions the integration needs (see below). You choose these yourself; they are not set by support. To grant the common charging permissions in one click, use the Quick select: Payments (charge & refund) shortcut.
3

Create and copy the token

Click Create token, then copy the token and store it somewhere safe. Treat it like a password.

​
Permissions

Permissions are grouped by area. The most important ones for common integrations: Payments
  • Charge & refund payments (transaction:charge-card-token) processes card payments, refunds, and voids. This is the single permission the WooCommerce plugin needs.
Customers
  • Create, read, update, and delete customer records (customer:create, customer:read, customer:update, customer:delete).
Invoicing
  • Read, create, update, delete, send, and charge hosted Dime invoices (invoice:read, invoice:create, invoice:update, invoice:delete, invoice:send, invoice:charge).
Recurring invoices
  • Read, create, and update recurring invoice schedules (recurring-invoice:read, recurring-invoice:create, recurring-invoice:update).
Subscriptions and plans
  • Manage subscription plans and individual subscriptions (subscription-plan:* and subscription:*).
Two things worth knowing: charging and refunding both use the single Charge & refund payments permission, and the invoice:* permissions apply only to hosted Dime invoices. In particular, invoice:charge collects payment on a hosted Dime invoice and is not the same as a WooCommerce charge.
For the complete list of every permission with its exact scope string, see the developer Authentication guide.

​
Managing existing tokens

Your existing tokens are listed under Your API tokens, showing each token’s name, its permissions, when it was last used, and when it was created. Each token has a Revoke action. Revoke a token the moment it is no longer needed or if you think it has been exposed. Revoking takes effect immediately and cannot be undone, so any integration still using that token will stop working until you issue it a new one.

​
Keeping tokens secure

  • Treat a token like a password and never post it publicly or commit it to a public repository
  • Use a separate token for each integration, so you can revoke one without affecting the others
  • Grant only the permissions the integration actually needs
  • Revoke and reissue right away if a token is exposed